dotnet9.0-9.0.122-1.el9_8.ML.1

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.122
Runtime version: 9.0.21

Security Fix(es):

* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
* dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
* dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
* dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
* dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
* dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
* dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
* dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
* dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
* dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
* dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
* dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)

Bug Fix(es) and Enhancement(s):

* Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [rhel-9.8.z] (JIRA:RHEL-277800)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-58280
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-66822
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-69651
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-70159
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70175
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-70179
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70181
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70183
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70186
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70188
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70196
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-88092
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVE-2026-92707
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.
CVE-2026-96225
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96230
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-96231
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96233
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-96236
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-96237
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-96238
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.