UBUNTU-CVE-2026-109476: Medium severity ubuntu/dotnet6 vulnerability
A crafted X-Forwarded-Prefix can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.04.1 - Configuration
Ensure cookie paths derived from PathBase percent-encode semicolons to prevent crafted X-Forwarded-Prefix values from injecting cookie path delimiters.
PathBase-derived cookie paths semicolon encoding = percent-encode semicolons
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply a crafted X-Forwarded-Prefix value, and a user must interact with the affected application. Exploitation also depends on the application deriving cookie paths from PathBase without percent-encoding semicolons.
Which Ubuntu .NET packages are identified as affected?
The advisory lists ubuntu/dotnet6, ubuntu/dotnet8, ubuntu/dotnet10, and ubuntu/dotnet11.
What is the potential impact?
The vulnerability can allow cookie path delimiter injection through a crafted X-Forwarded-Prefix. The supplied vector indicates high confidentiality impact, with no indicated integrity or availability impact.