UBUNTU-CVE-2026-114150: Medium severity ubuntu/dotnet7 vulnerability
Published Nov 10, 2026
·Updated
A reused ResponseBufferingStream can retain pooled tail memory and expose response-body data from another request through HTTP logging.
Affected Software
2 affected componentsFixes available
ubuntu/dotnet7*
ubuntu/dotnet11<11.0.100-11.0.0-0ubuntu1~26.10.1
11.0.100-11.0.0-0ubuntu1~26.10.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1
Event History
Nov 10, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The vulnerability is network-accessible and does not require authentication or user interaction. Exploitation has high attack complexity.
2
What is the security impact if exploitation succeeds?
The stated impact is high confidentiality impact, with no integrity or availability impact. Exposed data may include response-body content from another request through HTTP logging.
3
Which Ubuntu software is listed as affected?
The affected software listed is ubuntu/dotnet7 and ubuntu/dotnet11.