RHSA-2026:99143: Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.SDK version: 10.0.115Runtime version: 10.0.15Security Fix(es): dotnet8.0: dotnet11.0: dotnet9.0: dotnet10.0: ASP.NET Core Information Disclosure Vulnerability (CVE-2026-109476) dotnet11.0: dotnet10.0: dotnet9.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-105544) dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: .NET Denial of Service Vulnerability (CVE-2026-109475) dotnet9.0: dotnet11.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114146) dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114147) dotnet11.0: dotnet8.0: dotnet9.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-114149) Bug Fix(es) and Enhancement(s): Update .NET 10.0 to SDK 10.0.115 and Runtime 10.0.15 [rhel-10.3.z] (JIRA:RHEL-302525) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Other sources
Important: .NET 10.0 security, bug fix, and enhancement update
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
.NET 10.0 SDKto a version that resolves this vulnerability.Fixed in 10.0.115 - Upgrade
Upgrade
.NET 10.0 Runtimeto a version that resolves this vulnerability.Fixed in 10.0.15
Event History
Frequently Asked Questions
Which systems should be prioritized for this update?
Prioritize Red Hat Enterprise Linux systems running .NET 10.0, especially hosts that run ASP.NET Core applications. The advisory applies across x86_64, ARM 64, IBM z Systems, and Power little-endian offerings listed for RHEL, with related CodeReady Linux Builder repositories also listed.
Which vulnerability impacts are addressed?
The update addresses ASP.NET Core information disclosure, elevation of privilege, and denial-of-service vulnerabilities, as well as a .NET elevation-of-privilege vulnerability and a .NET denial-of-service vulnerability. The affected CVEs are CVE-2026-109476, CVE-2026-105544, CVE-2026-109475, CVE-2026-114146, CVE-2026-114147, and CVE-2026-114149.
What versions does this update provide?
It updates .NET 10.0 to SDK version 10.0.115 and Runtime version 10.0.15.