RHSA-2026:99598: Red Hat Hardened Images RPMs Security Update

Published Nov 12, 2026

Updated

Red Hat Hardened Images RPMs Security Update

Other sources

This update includes the following RPMs:dotnet9.0: aspnetcore-runtime-9.0-9.0.23-0.1.hum1 (aarch64, x8664) aspnetcore-runtime-dbg-9.0-9.0.23-0.1.hum1 (aarch64, x8664) aspnetcore-targeting-pack-9.0-9.0.23-0.1.hum1 (aarch64, x8664) dotnet-apphost-pack-9.0-9.0.23-0.1.hum1 (aarch64, x8664) dotnet-hostfxr-9.0-9.0.23-0.1.hum1 (aarch64, x8664) dotnet-runtime-9.0-9.0.23-0.1.hum1 (aarch64, x8664) dotnet-runtime-dbg-9.0-9.0.23-0.1.hum1 (aarch64, x8664) dotnet-sdk-9.0-9.0.124-0.1.hum1 (aarch64, x8664) dotnet-sdk-9.0-source-built-artifacts-9.0.124-0.1.hum1 (aarch64, x8664) dotnet-sdk-aot-9.0-9.0.124-0.1.hum1 (aarch64, x8664) dotnet-sdk-dbg-9.0-9.0.124-0.1.hum1 (aarch64, x8664) dotnet-targeting-pack-9.0-9.0.23-0.1.hum1 (aarch64, x8664) dotnet-templates-9.0-9.0.124-0.1.hum1 (aarch64, x8664) netstandard-targeting-pack-2.1-9.0.124-0.1.hum1 (aarch64, x8664) dotnet9.0-9.0.124-0.1.hum1.src (src) Security Fix(es):dotnet9.0: CVE-2026-114146 CVE-2026-114149

— Red Hat

Affected Software

1 affected component

Red Hat Red Hat Hardened Images

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade dotnet9.0 runtime and targeting-pack RPMs to a version that resolves this vulnerability.
Fixed in 9.0.23-0.1.hum1
Upgrade
Upgrade dotnet9.0 SDK, templates, and netstandard-targeting-pack RPMs to a version that resolves this vulnerability.
Fixed in 9.0.124-0.1.hum1

Event History

Nov 12, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·10:27 AM

Data Sourced

via Red Hat·10:27 AM

Severity

Frequently Asked Questions

Which systems should be prioritized for this update?

Prioritize Red Hat Hardened Images deployments that include the listed dotnet9.0 runtime, ASP.NET Core runtime, SDK, targeting-pack, hostfxr, or related packages. The advisory provides updated packages for both aarch64 and x86_64 architectures.

Which security issues are addressed by the update?

The update addresses CVE-2026-114146 and CVE-2026-114149 in dotnet9.0.

How can I determine whether the updated packages are installed?

Check the installed dotnet9.0 package versions against the advisory's updated builds. Runtime-related packages are updated to 9.0.23-0.1.hum1, while the listed SDK, templates, targeting, and source-built artifact packages are updated to 9.0.124-0.1.hum1.