CVE-2026-47300
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Record
CVE-2026-47300- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-303
- Updated
- 2026-11-02
EUVDEUVD-2026-44342
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Record
EUVD-2026-44342- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8prm-248r-h957
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An elevation of privilege vulnerability exists in the ASP.NET Core Negotiate authentication handler in .NET 8, .NET 9, and .NET 10 due to improper validation.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD
CVSS Details
- Version: 3.1
- Severity: High
- Score: 8.8
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-303 (Incorrect Implementation of Authentication Algorithm)
Affected Platforms
- Platforms: All
- Architectures: All
Mitigation Factors
Your ASP.NET Core app is only affected if it uses Negotiate authentication and LDAP to retrieve role information.
<a name="affected-packages"></a>Affected Packages
The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below
<a name=".NET 10.0"></a>.NET 10.0
Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 10.0.0, <= 10.0.9 | 10.0.10
<a name=".NET 9.0"></a>.NET 9.0
Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 9.0.0, <= 9.0.17 | 9.0.18
<a name=".NET 8.0"></a>.NET 8.0
Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 8.0.0, <= 8.0.28 | 8.0.29
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
If using a package listed in affected packages, you're exposed to the vulnerability.
<a name="how-fix"></a>How do I fix the issue?
- To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
- If your application references the vulnerable nuget package, update the package reference to the patched version. You can list the versions you have installed by running the
dotnet --infocommand.
Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.
Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
Other Information
Reporting Security Issues
If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.
Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
Support
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo…
- Record
GHSA-8prm-248r-h957- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-303
- Updated
- 2026-11-02
NVD
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Record
CVE-2026-47300- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-303
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-47300
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Record
ALPINE-CVE-2026-47300- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVGHSA-8prm-248r-h957
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An elevation of privilege vulnerability exists in the ASP.NET Core Negotiate authentication handler in .NET 8, .NET 9, and .NET 10 due to improper validation.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD
CVSS Details
- Version: 3.1
- Severity: High
- Score: 8.8
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-303 (Incorrect Implementation of Authentication Algorithm)
Affected Platforms
- Platforms: All
- Architectures: All
Mitigation Factors
Your ASP.NET Core app is only affected if it uses Negotiate authentication and LDAP to retrieve role information.
<a name="affected-packages"></a>Affected Packages
The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below
<a name=".NET 10.0"></a>.NET 10.0
Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 10.0.0, <= 10.0.9 | 10.0.10
<a name=".NET 9.0"></a>.NET 9.0
Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 9.0.0, <= 9.0.17 | 9.0.18
<a name=".NET 8.0"></a>.NET 8.0
Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 8.0.0, <= 8.0.28 | 8.0.29
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
If using a package listed in affected packages, you're exposed to the vulnerability.
<a name="how-fix"></a>How do I fix the issue?
- To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
- If your application references the vulnerable nuget package, update the package reference to the patched version. You can list the versions you have installed by running the
dotnet --infocommand.
Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.
Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
Other Information
Reporting Security Issues
If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.
Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
Support
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo…
- Record
GHSA-8prm-248r-h957- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-303
- Updated
- 2026-11-02
Show 39 moreShow less
OSVRHSA-2026:26638
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:26638- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:39952
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:39952- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41893
Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41893- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41894
Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41894- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41895
Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41895- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41896
Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41896- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41897
Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41897- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41898
Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41898- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41899
Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41899- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41900
Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41900- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:41901
Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update
- Record
RHSA-2026:41901- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:42145
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:42145- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:58566
Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update
- Record
RHSA-2026:58566- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:58567
Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update
- Record
RHSA-2026:58567- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:58568
Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update
- Record
RHSA-2026:58568- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:58569
Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update
- Record
RHSA-2026:58569- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:58570
Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update
- Record
RHSA-2026:58570- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41893
Important: .NET 8.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
-
Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-10.2.z] (JIRA:Rocky Linux-192468)
-
dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192329)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41893- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41894
Important: .NET 8.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
-
Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-9.8.z] (JIRA:Rocky Linux-192467)
-
dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192337)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41894- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41895
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
-
Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-10.2.z] (JIRA:Rocky Linux-192473)
-
dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192330)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41895- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41896
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
-
Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-9.8.z] (JIRA:Rocky Linux-192472)
-
dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192338)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41896- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41897
Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
-
Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-10.2.z] (JIRA:Rocky Linux-192463)
-
dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192326)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41897- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41898
Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
-
Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-9.8.z] (JIRA:Rocky Linux-192462)
-
dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192336)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41898- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41899
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 (JIRA:Rocky Linux-192469)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41899- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41900
Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:Rocky Linux-192459)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41900- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:41901
Important: .NET 8.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.
Security Fix(es):
-
dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
-
dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
-
ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
-
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
-
ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
-
dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
-
dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
-
dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
-
dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
-
dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
-
dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
-
dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
-
dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
-
dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
-
dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
-
.NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
-
dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 (JIRA:Rocky Linux-192464)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:41901- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-47300
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Record
UBUNTU-CVE-2026-47300- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:41893 No score
Important: .NET 8.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468)
- dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41893- Updated
- 2026-11-02
OSVALSA-2026:41894 No score
Important: .NET 8.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-9.8.z] (JIRA:AlmaLinux-192467)
- dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192337)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41894- Updated
- 2026-11-02
OSVALSA-2026:41895 No score
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473)
- dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41895- Updated
- 2026-11-02
OSVALSA-2026:41896 No score
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-9.8.z] (JIRA:AlmaLinux-192472)
- dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192338)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41896- Updated
- 2026-11-02
OSVALSA-2026:41897 No score
Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463)
- dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41897- Updated
- 2026-11-02
OSVALSA-2026:41898 No score
Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-9.8.z] (JIRA:AlmaLinux-192462)
- dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192336)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41898- Updated
- 2026-11-02
OSVALSA-2026:41899 No score
Important: .NET 9.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 (JIRA:AlmaLinux-192469)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41899- Updated
- 2026-11-02
OSVALSA-2026:41900 No score
Important: .NET 10.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:AlmaLinux-192459)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41900- Updated
- 2026-11-02
OSVALSA-2026:41901 No score
Important: .NET 8.0 security, bug fix, and enhancement update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.
Security Fix(es):
- dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
- dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
- ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
- ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
- ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
- dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
- dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
- dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
- dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
- dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
- dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
- dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
- dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
- dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
- dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
- .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
- dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)
Bug Fix(es) and Enhancement(s):
- Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 (JIRA:AlmaLinux-192464)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:41901- Updated
- 2026-11-02
OSVBIT-dotnet-2026-47300 No score
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Record
BIT-dotnet-2026-47300- Updated
- 2026-11-02
OSVBIT-dotnet-sdk-2026-47300 No score
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Record
BIT-dotnet-sdk-2026-47300- Updated
- 2026-11-02
OSVUSN-8553-1 No score
dotnet8, dotnet10 vulnerabilities
Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue to elevate privileges. (CVE-2026-47300)
Levi Broderick discovered that .NET did not properly handle XML encryption during parsing. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-47302)
Pham Quang Minh discovered that .NET did not properly parse authentication data. An attacker could possibly use this issue to bypass authentication and elevate privileges. (CVE-2026-47303)
Levi Broderick discovered that .NET did not properly verify cryptographic signatures during XML encryption. An attacker could possibly use this issue to bypass security features over a network and access encrypted data. (CVE-2026-47304)
It was discovered that .NET did not properly validate input during TLS handshakes. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. (CVE-2026-50524)
Levi Broderick discovered that .NET did not properly handle resource allocation during XML encryption. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-50525)
Siwei Li discovered that .NET did not properly handle link resolution before file access during the container image build process. A local attacker could possibly use this issue to inject resources that could be incorporated into container images built by other users on the same machine. (CVE-2026-50526)
Levi Broderick discovered that .NET did not properly handle memory while performing XML encryption. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. (CVE-2026-50527)
Henrique Pereira discovered that .NET did not properly handle authorization checks during TLS/SSL connections. An attacker could possibly use this issue to bypass authorization checks during secure communications. (CVE-2026-50528)
It was discovered that .NET did not properly handle resource allocation during XML encryption. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-50648)
Miha Zupan discovered that .NET did not properly limit resource allocation when handling HTTP/2 requests. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-50651)
It was discovered that the .NET SMTP client did not properly handle the encoding or escaping of output. An attacker could possibly use this issue to spoof messages during message routing. (CVE-2026-50659)
It was discovered that .NET did not properly validate resource types when parsing X.509 certificates. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. (CVE-2026-57108)
- Record
USN-8553-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.Authentication.NegotiateNuGet |
10.0.0 to 10.0.9 | 10.0.10 |
Microsoft.AspNetCore.Authentication.NegotiateNuGet |
9.0.0 to 9.0.17 | 9.0.18 |
Microsoft.AspNetCore.Authentication.NegotiateNuGet |
8.0.0 to 8.0.28 | 8.0.29 |
dotnet10-runtimeAlpine:v3.23 |
before 10.0.10-r0 | 10.0.10-r0 |
dotnet10-runtimeAlpine:v3.24 |
before 10.0.10-r0 | 10.0.10-r0 |
dotnet8-runtimeAlpine:v3.22 |
before 8.0.29-r0 | 8.0.29-r0 |
dotnet8-runtimeAlpine:v3.23 |
before 8.0.29-r0 | 8.0.29-r0 |
dotnet8-runtimeAlpine:v3.24 |
before 8.0.29-r0 | 8.0.29-r0 |
dotnet9-runtimeAlpine:v3.22 |
before 9.0.18-r0 | 9.0.18-r0 |
dotnet9-runtimeAlpine:v3.23 |
before 9.0.18-r0 | 9.0.18-r0 |
Show 290 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dotnet9-runtimeAlpine:v3.24 |
before 9.0.18-r0 | 9.0.18-r0 |
aspnetcore-runtime-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
aspnetcore-runtime-dbg-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
aspnetcore-targeting-pack-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
dotnet-apphost-pack-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
dotnet-hostfxr-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
dotnet-runtime-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
dotnet-runtime-dbg-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
dotnet-sdk-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.129-1.el10_2 | 8.0.129-1.el10_2 |
dotnet-sdk-8.0-source-built-artifactsAlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.129-1.el10_2 | 8.0.129-1.el10_2 |
dotnet-sdk-dbg-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.129-1.el10_2 | 8.0.129-1.el10_2 |
dotnet-targeting-pack-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.29-1.el10_2 | 8.0.29-1.el10_2 |
dotnet-templates-8.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 8.0.129-1.el10_2 | 8.0.129-1.el10_2 |
aspnetcore-runtime-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
aspnetcore-runtime-dbg-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
aspnetcore-targeting-pack-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
dotnet-apphost-pack-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
dotnet-hostfxr-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
dotnet-runtime-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
dotnet-runtime-dbg-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
dotnet-sdk-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.129-1.el9_8 | 8.0.129-1.el9_8 |
dotnet-sdk-8.0-source-built-artifactsAlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.129-1.el9_8 | 8.0.129-1.el9_8 |
dotnet-sdk-dbg-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.129-1.el9_8 | 8.0.129-1.el9_8 |
dotnet-targeting-pack-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.29-1.el9_8 | 8.0.29-1.el9_8 |
dotnet-templates-8.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 8.0.129-1.el9_8 | 8.0.129-1.el9_8 |
aspnetcore-runtime-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
aspnetcore-runtime-dbg-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
aspnetcore-targeting-pack-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
dotnet-apphost-pack-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
dotnet-hostfxr-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
dotnet-runtime-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
dotnet-runtime-dbg-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
dotnet-sdk-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.119-1.el10_2 | 9.0.119-1.el10_2 |
dotnet-sdk-9.0-source-built-artifactsAlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.119-1.el10_2 | 9.0.119-1.el10_2 |
dotnet-sdk-aot-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.119-1.el10_2 | 9.0.119-1.el10_2 |
dotnet-sdk-dbg-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.119-1.el10_2 | 9.0.119-1.el10_2 |
dotnet-targeting-pack-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.18-1.el10_2 | 9.0.18-1.el10_2 |
dotnet-templates-9.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.119-1.el10_2 | 9.0.119-1.el10_2 |
netstandard-targeting-pack-2.1AlmaLinux:10 From an advisory covering 17 CVEs |
before 9.0.119-1.el10_2 | 9.0.119-1.el10_2 |
aspnetcore-runtime-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
aspnetcore-runtime-dbg-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
aspnetcore-targeting-pack-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
dotnet-apphost-pack-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
dotnet-hostfxr-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
dotnet-runtime-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
dotnet-runtime-dbg-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
dotnet-sdk-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.119-1.el9_8 | 9.0.119-1.el9_8 |
dotnet-sdk-9.0-source-built-artifactsAlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.119-1.el9_8 | 9.0.119-1.el9_8 |
dotnet-sdk-aot-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.119-1.el9_8 | 9.0.119-1.el9_8 |
dotnet-sdk-dbg-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.119-1.el9_8 | 9.0.119-1.el9_8 |
dotnet-targeting-pack-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.18-1.el9_8 | 9.0.18-1.el9_8 |
dotnet-templates-9.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.119-1.el9_8 | 9.0.119-1.el9_8 |
netstandard-targeting-pack-2.1AlmaLinux:9 From an advisory covering 17 CVEs |
before 9.0.119-1.el9_8 | 9.0.119-1.el9_8 |
aspnetcore-runtime-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
aspnetcore-runtime-dbg-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
aspnetcore-targeting-pack-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
dotnet-apphost-pack-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
dotnet-hostAlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
dotnet-hostfxr-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
dotnet-runtime-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
dotnet-runtime-dbg-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
dotnet-sdk-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.110-1.el10_2 | 10.0.110-1.el10_2 |
dotnet-sdk-10.0-source-built-artifactsAlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.110-1.el10_2 | 10.0.110-1.el10_2 |
dotnet-sdk-aot-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.110-1.el10_2 | 10.0.110-1.el10_2 |
dotnet-sdk-dbg-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.110-1.el10_2 | 10.0.110-1.el10_2 |
dotnet-targeting-pack-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.10-1.el10_2 | 10.0.10-1.el10_2 |
dotnet-templates-10.0AlmaLinux:10 From an advisory covering 17 CVEs |
before 10.0.110-1.el10_2 | 10.0.110-1.el10_2 |
aspnetcore-runtime-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
aspnetcore-runtime-dbg-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
aspnetcore-targeting-pack-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
dotnet-apphost-pack-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
dotnet-hostAlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
dotnet-hostfxr-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
dotnet-runtime-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
dotnet-runtime-dbg-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
dotnet-sdk-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.110-1.el9_8 | 10.0.110-1.el9_8 |
dotnet-sdk-10.0-source-built-artifactsAlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.110-1.el9_8 | 10.0.110-1.el9_8 |
dotnet-sdk-aot-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.110-1.el9_8 | 10.0.110-1.el9_8 |
dotnet-sdk-dbg-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.110-1.el9_8 | 10.0.110-1.el9_8 |
dotnet-targeting-pack-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.10-1.el9_8 | 10.0.10-1.el9_8 |
dotnet-templates-10.0AlmaLinux:9 From an advisory covering 17 CVEs |
before 10.0.110-1.el9_8 | 10.0.110-1.el9_8 |
aspnetcore-runtime-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
aspnetcore-runtime-dbg-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
aspnetcore-targeting-pack-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
dotnet-apphost-pack-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
dotnet-hostfxr-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
dotnet-runtime-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
dotnet-runtime-dbg-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
dotnet-sdk-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.119-1.el8_10 | 9.0.119-1.el8_10 |
dotnet-sdk-9.0-source-built-artifactsAlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.119-1.el8_10 | 9.0.119-1.el8_10 |
dotnet-sdk-aot-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.119-1.el8_10 | 9.0.119-1.el8_10 |
dotnet-sdk-dbg-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.119-1.el8_10 | 9.0.119-1.el8_10 |
dotnet-targeting-pack-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.18-1.el8_10 | 9.0.18-1.el8_10 |
dotnet-templates-9.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.119-1.el8_10 | 9.0.119-1.el8_10 |
netstandard-targeting-pack-2.1AlmaLinux:8 From an advisory covering 17 CVEs |
before 9.0.119-1.el8_10 | 9.0.119-1.el8_10 |
aspnetcore-runtime-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
aspnetcore-runtime-dbg-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
aspnetcore-targeting-pack-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
dotnetAlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.110-1.el8_10 | 10.0.110-1.el8_10 |
dotnet-apphost-pack-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
dotnet-hostAlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
dotnet-hostfxr-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
dotnet-runtime-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
dotnet-runtime-dbg-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
dotnet-sdk-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.110-1.el8_10 | 10.0.110-1.el8_10 |
dotnet-sdk-10.0-source-built-artifactsAlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.110-1.el8_10 | 10.0.110-1.el8_10 |
dotnet-sdk-aot-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.110-1.el8_10 | 10.0.110-1.el8_10 |
dotnet-sdk-dbg-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.110-1.el8_10 | 10.0.110-1.el8_10 |
dotnet-targeting-pack-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.10-1.el8_10 | 10.0.10-1.el8_10 |
dotnet-templates-10.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 10.0.110-1.el8_10 | 10.0.110-1.el8_10 |
aspnetcore-runtime-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
aspnetcore-runtime-dbg-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
aspnetcore-targeting-pack-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
dotnet-apphost-pack-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
dotnet-hostfxr-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
dotnet-runtime-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
dotnet-runtime-dbg-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
dotnet-sdk-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.129-1.el8_10 | 8.0.129-1.el8_10 |
dotnet-sdk-8.0-source-built-artifactsAlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.129-1.el8_10 | 8.0.129-1.el8_10 |
dotnet-sdk-dbg-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.129-1.el8_10 | 8.0.129-1.el8_10 |
dotnet-targeting-pack-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.29-1.el8_10 | 8.0.29-1.el8_10 |
dotnet-templates-8.0AlmaLinux:8 From an advisory covering 17 CVEs |
before 8.0.129-1.el8_10 | 8.0.129-1.el8_10 |
dotnetBitnami |
8.0.0 up to 8.0.29, 9.0.0 up to 9.0.18, 10.0.0 up to 10.0.6 | 8.0.299.0.1810.0.6 |
dotnet-sdkBitnami |
8.0.0 up to 8.0.29, 9.0.0 up to 9.0.18, 10.0.0 up to 10.0.6 | 8.0.299.0.1810.0.6 |
Microsoft.AspNetCore.Authentication.NegotiateNuGet |
10.0.0 up to 10.0.10, plus listed versions 10.0.110.0.210.0.310.0.410.0.5 Show 4 moreShow less10.0.610.0.710.0.810.0.9 |
10.0.10 |
Microsoft.AspNetCore.Authentication.NegotiateNuGet |
9.0.0 up to 9.0.18, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 12 moreShow less9.0.149.0.159.0.169.0.179.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9 |
9.0.18 |
Microsoft.AspNetCore.Authentication.NegotiateNuGet |
8.0.0 up to 8.0.29, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 22 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.38.0.48.0.58.0.68.0.78.0.8 |
8.0.29 |
dotnet-sdk-10.0Red Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:10.0.109-1.hum1 | 0:10.0.109-1.hum1 |
dotnet-sdk-10.0-source-built-artifactsRed Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:10.0.109-1.hum1 | 0:10.0.109-1.hum1 |
dotnet-sdk-aot-10.0Red Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:10.0.109-1.hum1 | 0:10.0.109-1.hum1 |
dotnet-sdk-dbg-10.0Red Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:10.0.109-1.hum1 | 0:10.0.109-1.hum1 |
dotnet-templates-10.0Red Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:10.0.109-1.hum1 | 0:10.0.109-1.hum1 |
dotnet10.0Red Hat:hummingbird:1 From an advisory covering 16 CVEs |
before 0:10.0.109-1.hum1 | 0:10.0.109-1.hum1 |
dotnet-sdk-9.0Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:9.0.119-1.hum1 | 0:9.0.119-1.hum1 |
dotnet-sdk-9.0-source-built-artifactsRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:9.0.119-1.hum1 | 0:9.0.119-1.hum1 |
dotnet-sdk-aot-9.0Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:9.0.119-1.hum1 | 0:9.0.119-1.hum1 |
dotnet-sdk-dbg-9.0Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:9.0.119-1.hum1 | 0:9.0.119-1.hum1 |
dotnet-templates-9.0Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:9.0.119-1.hum1 | 0:9.0.119-1.hum1 |
dotnet9.0Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:9.0.119-1.hum1 | 0:9.0.119-1.hum1 |
netstandard-targeting-pack-2.1Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:9.0.119-1.hum1 | 0:9.0.119-1.hum1 |
aspnetcore-runtime-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
aspnetcore-runtime-dbg-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
aspnetcore-targeting-pack-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-apphost-pack-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-apphost-pack-8.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-hostfxr-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-hostfxr-8.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-runtime-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-runtime-8.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-runtime-dbg-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-sdk-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
dotnet-sdk-8.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
dotnet-sdk-dbg-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
dotnet-targeting-pack-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.29-1.el10_2 | 0:8.0.29-1.el10_2 |
dotnet-templates-8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
dotnet8.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
dotnet8.0-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
dotnet-sdk-8.0-source-built-artifactsRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
aspnetcore-runtime-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
aspnetcore-runtime-dbg-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
aspnetcore-targeting-pack-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-apphost-pack-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-apphost-pack-8.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-hostfxr-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-hostfxr-8.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-runtime-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-runtime-8.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-runtime-dbg-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-sdk-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet-sdk-8.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet-sdk-dbg-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet-targeting-pack-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-templates-8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet8.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet8.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet8.0-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet-apphost-pack-8.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-hostfxr-8.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-runtime-8.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:8.0.29-1.el9_8 | 0:8.0.29-1.el9_8 |
dotnet-sdk-8.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet-sdk-8.0-source-built-artifactsRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet8.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet8.0-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
aspnetcore-runtime-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
aspnetcore-runtime-dbg-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
aspnetcore-targeting-pack-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-apphost-pack-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-apphost-pack-9.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-hostfxr-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-hostfxr-9.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-runtime-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-runtime-9.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-runtime-dbg-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-sdk-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet-sdk-9.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet-sdk-aot-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet-sdk-aot-9.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet-sdk-dbg-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet-targeting-pack-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.18-1.el10_2 | 0:9.0.18-1.el10_2 |
dotnet-templates-9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet9.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet9.0-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet-sdk-9.0-source-built-artifactsRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
aspnetcore-runtime-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
aspnetcore-runtime-dbg-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
aspnetcore-targeting-pack-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-apphost-pack-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-apphost-pack-9.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-hostfxr-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-hostfxr-9.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-runtime-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-runtime-9.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-runtime-dbg-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-sdk-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-sdk-9.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-sdk-aot-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-sdk-aot-9.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-sdk-dbg-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-targeting-pack-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-templates-9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet9.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet9.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet9.0-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
netstandard-targeting-pack-2.1Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-apphost-pack-9.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-hostfxr-9.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-runtime-9.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.18-1.el9_8 | 0:9.0.18-1.el9_8 |
dotnet-sdk-9.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-sdk-9.0-source-built-artifactsRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet-sdk-aot-9.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet9.0-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet9.0-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
aspnetcore-runtime-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
aspnetcore-runtime-dbg-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
aspnetcore-targeting-pack-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-apphost-pack-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-apphost-pack-10.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-hostRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-host-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-hostfxr-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-hostfxr-10.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-runtime-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-runtime-10.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-runtime-dbg-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-sdk-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet-sdk-10.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet-sdk-aot-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet-sdk-aot-10.0-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet-sdk-dbg-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet-targeting-pack-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.10-1.el10_2 | 0:10.0.10-1.el10_2 |
dotnet-templates-10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet10.0Red Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet10.0-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet-sdk-10.0-source-built-artifactsRed Hat:enterprise_linux:10.2 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
aspnetcore-runtime-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
aspnetcore-runtime-dbg-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
aspnetcore-targeting-pack-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-apphost-pack-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-apphost-pack-10.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-hostRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-host-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-hostfxr-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-hostfxr-10.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-runtime-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-runtime-10.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-runtime-dbg-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-sdk-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet-sdk-10.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet-sdk-aot-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet-sdk-aot-10.0-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet-sdk-dbg-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet-targeting-pack-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.10-1.el9_8 | 0:10.0.10-1.el9_8 |
dotnet-templates-10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet10.0Red Hat:enterprise_linux:9::appstream From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet8.0Rocky Linux:10 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el10_2 | 0:8.0.129-1.el10_2 |
dotnet8.0Rocky Linux:9 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el9_8 | 0:8.0.129-1.el9_8 |
dotnet9.0Rocky Linux:10 From an advisory covering 16 CVEs |
before 0:9.0.119-1.el10_2 | 0:9.0.119-1.el10_2 |
dotnet9.0Rocky Linux:9 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el9_8 | 0:9.0.119-1.el9_8 |
dotnet10.0Rocky Linux:10 From an advisory covering 16 CVEs |
before 0:10.0.110-1.el10_2 | 0:10.0.110-1.el10_2 |
dotnet10.0Rocky Linux:9 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el9_8 | 0:10.0.110-1.el9_8 |
dotnet9.0Rocky Linux:8 From an advisory covering 17 CVEs |
before 0:9.0.119-1.el8_10 | 0:9.0.119-1.el8_10 |
dotnet10.0Rocky Linux:8 From an advisory covering 17 CVEs |
before 0:10.0.110-1.el8_10 | 0:10.0.110-1.el8_10 |
dotnet8.0Rocky Linux:8 From an advisory covering 17 CVEs |
before 0:8.0.129-1.el8_10 | 0:8.0.129-1.el8_10 |
dotnet6Ubuntu:22.04:LTS |
All versions, plus listed versions 6.0.108-0ubuntu1~22.04.16.0.109-0ubuntu1~22.04.16.0.110-0ubuntu1~22.04.16.0.111-0ubuntu1~22.04.16.0.113-0ubuntu1~22.04.1 Show 16 moreShow less6.0.116-0ubuntu1~22.04.16.0.118-0ubuntu1~22.04.16.0.119-0ubuntu1~22.04.16.0.120-0ubuntu1~22.04.16.0.121-0ubuntu1~22.04.16.0.122-0ubuntu1~22.04.16.0.123-0ubuntu1~22.04.16.0.124-0ubuntu1~22.04.16.0.125-0ubuntu1~22.04.16.0.126-0ubuntu1~22.04.16.0.127-0ubuntu1~22.04.16.0.128-0ubuntu1~22.04.26.0.132-0ubuntu1~22.04.16.0.133-0ubuntu1~22.04.16.0.135-0ubuntu1~22.04.16.0.136-0ubuntu1~22.04.1 |
None known |
dotnet7Ubuntu:22.04:LTS |
All versions, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1 Show 9 moreShow less7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1 |
None known |
dotnet8Ubuntu:22.04:LTS |
before 8.0.129-8.0.29-0ubuntu1~22.04.1, plus listed versions 8.0.102-8.0.2-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.28.0.105-8.0.5-0ubuntu1~22.04.18.0.107-8.0.7-0ubuntu1~22.04.1 Show 19 moreShow less8.0.108-8.0.8-0ubuntu1~22.04.18.0.110-8.0.10-0ubuntu1~22.04.18.0.111-8.0.11-0ubuntu1~22.04.18.0.112-8.0.12-0ubuntu1~22.04.18.0.114-8.0.14-0ubuntu1~22.04.18.0.115-8.0.15-0ubuntu1~22.04.18.0.116-8.0.16-0ubuntu1~22.04.18.0.117-8.0.17-0ubuntu1~22.04.18.0.118-8.0.18-0ubuntu1~22.04.18.0.119-8.0.19-0ubuntu1~22.04.18.0.120-8.0.20-0ubuntu1~22.04.18.0.121-8.0.21-0ubuntu1~22.04.18.0.122-8.0.22-0ubuntu1~22.04.18.0.123-8.0.23-0ubuntu1~22.04.18.0.124-8.0.24-0ubuntu1~22.04.18.0.125-8.0.25-0ubuntu1~22.04.18.0.126-8.0.26-0ubuntu1~22.04.18.0.127-8.0.27-0ubuntu1~22.04.18.0.128-8.0.28-0ubuntu1~22.04.1 |
8.0.129-8.0.29-0ubuntu1~22.04.1 |
dotnet10Ubuntu:24.04:LTS |
before 10.0.110-10.0.10-0ubuntu1~24.04.1, plus listed versions 10.0.100-10.0.0-0ubuntu1~24.04.110.0.101-10.0.1-0ubuntu1~24.04.210.0.103-10.0.3-0ubuntu1~24.04.110.0.104-10.0.4-0ubuntu1~24.04.110.0.105-10.0.5-0ubuntu1~24.04.1 Show 4 moreShow less10.0.106-10.0.6-0ubuntu1~24.04.110.0.107-10.0.7-0ubuntu1~24.04.110.0.108-10.0.8-0ubuntu1~24.04.110.0.109-10.0.9-0ubuntu1~24.04.1 |
10.0.110-10.0.10-0ubuntu1~24.04.1 |
dotnet8Ubuntu:24.04:LTS |
before 8.0.129-8.0.29-0ubuntu1~24.04.1, plus listed versions 8.0.100-8.0.0~rc1-0ubuntu18.0.100-8.0.0~rc2-0ubuntu18.0.100-8.0.0~rc2-0ubuntu28.0.100-8.0.0-0ubuntu18.0.100-8.0.0-0ubuntu2 Show 28 moreShow less8.0.101-8.0.1-0ubuntu18.0.101-8.0.1-0ubuntu28.0.102-8.0.2-0ubuntu18.0.103-8.0.3-0ubuntu28.0.103-8.0.3-0ubuntu38.0.104-8.0.4-0ubuntu18.0.105-8.0.5-0ubuntu1~24.04.18.0.107-8.0.7-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.28.0.110-8.0.10-0ubuntu1~24.04.18.0.111-8.0.11-0ubuntu1~24.04.18.0.112-8.0.12-0ubuntu1~24.04.18.0.114-8.0.14-0ubuntu1~24.04.18.0.115-8.0.15-0ubuntu1~24.04.18.0.116-8.0.16-0ubuntu1~24.04.18.0.117-8.0.17-0ubuntu1~24.04.18.0.118-8.0.18-0ubuntu1~24.04.18.0.119-8.0.19-0ubuntu1~24.04.18.0.120-8.0.20-0ubuntu1~24.04.18.0.121-8.0.21-0ubuntu1~24.04.18.0.122-8.0.22-0ubuntu1~24.04.18.0.123-8.0.23-0ubuntu1~24.04.18.0.124-8.0.24-0ubuntu1~24.04.18.0.125-8.0.25-0ubuntu1~24.04.18.0.126-8.0.26-0ubuntu1~24.04.18.0.127-8.0.27-0ubuntu1~24.04.18.0.128-8.0.28-0ubuntu1~24.04.1 |
8.0.129-8.0.29-0ubuntu1~24.04.1 |
dotnet10Ubuntu:26.04:LTS |
before 10.0.110-10.0.10-0ubuntu1~26.04.1, plus listed versions 10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu110.0.100-10.0.0-0ubuntu110.0.100-10.0.0-0ubuntu210.0.101-10.0.1-0ubuntu1 Show 9 moreShow less10.0.101-10.0.1-0ubuntu210.0.101-10.0.1-0ubuntu310.0.102-10.0.2-0ubuntu110.0.103-10.0.3-0ubuntu110.0.104-10.0.4-0ubuntu110.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1~26.04.110.0.109-10.0.9-0ubuntu1~26.04.1 |
10.0.110-10.0.10-0ubuntu1~26.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| affected, aliases | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47300 is a high vulnerability (CVSS 8.8) in Microsoft .net, published June 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in Microsoft.AspNetCore.Authentication.Negotiate 10.0.10.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300
github.com/dotnet/aspnetcore/security/advisories/GHSA-8prm-248r-h957
nvd.nist.gov/vuln/detail/CVE-2026-47300
Show 194 moreShow less
security.alpinelinux.org/vuln/CVE-2026-47300
access.redhat.com/errata/RHSA-2026:41893
bugzilla.redhat.com/2499217
errata.almalinux.org/10/ALSA-2026-41893.html
redhat.com/security/data/cve/CVE-2026-50525.html
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26638.json
cve.org/CVERecord?id=CVE-2026-45491
errata.rockylinux.org/RLSA-2026:41893
ubuntu.com/security/CVE-2026-47300
devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-july-2026-servicing-updates
Left out here: 229 package rows, 8 references and the rest of 2 source descriptions. The JSON record has them.