UBUNTU-CVE-2026-109478: High severity ubuntu/dotnet6 vulnerability
Processing comma-separated HTTP header values can cause excessive allocations and resource exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~24.04.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected software listed is ubuntu/dotnet8 and ubuntu/dotnet6. The network attack vector and lack of required privileges or user interaction indicate that reachable applications processing HTTP requests are the relevant exposure.
What does an attacker need to exploit it?
An attacker needs network access to send HTTP requests containing comma-separated header values. No authentication, privileges, or user interaction are required according to the provided vector.
What is the likely operational impact?
Successful exploitation can cause excessive memory allocations and resource exhaustion, resulting in an availability impact. The provided vector indicates no confidentiality or integrity impact.