UBUNTU-CVE-2026-114149: High severity ubuntu/dotnet6 vulnerability
Multipart form processing can bypass the configured header-count limit and consume excessive resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker able to send multipart form requests to an affected service can exploit it remotely. No privileges or user interaction are required.
What is the likely impact?
The issue can consume excessive resources and cause a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
Which Ubuntu packages are identified as affected?
The affected software list includes ubuntu/dotnet6, ubuntu/dotnet8, ubuntu/dotnet10, and ubuntu/dotnet11.