Every CVE Search/ Get API key

CVE-2026-47303

ASP.NET Core Elevation of Privilege Vulnerability

8.8 HighFix available

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.84%Up 0.3 points since Jul 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Record
CVE-2026-47303
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Weakness
CWE-302, CWE-863, CWE-90
Updated
2026-11-02
EUVDEUVD-2026-44354 8.8

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Record
EUVD-2026-44354
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-2p3q-h3hg-jcqq 8.8

Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An elevation of privilege vulnerability exists in the ASP.NET Core Negotiate authentication handler in .NET 8, .NET 9, and .NET 10 due to improper parsing.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 8.8
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Weakness: CWE-302 (Authentication Bypass by Assumed-Immutable Data), CWE-863 (Incorrect Authorization), CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))

Affected Platforms

  • Platforms: All
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

<a name=".NET 10"></a>.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 10.0.0, <= 10.0.9 | 10.0.10

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 9.0.0, <= 9.0.17 | 9.0.18

<a name=".NET 8"></a>.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 8.0.0, <= 8.0.28 | 8.0.29

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

  1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
  2. If your application references the vulnerable nuget package, update the package reference to the patched version. You can list the versions you have installed by running the dotnet --info command.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin…

Record
GHSA-2p3q-h3hg-jcqq
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-90, CWE-302, CWE-863
Updated
2026-11-02
NVD 8.8

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Record
CVE-2026-47303
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-90, CWE-302, CWE-863
Updated
2026-11-02
OSVALPINE-CVE-2026-47303 8.8

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Record
ALPINE-CVE-2026-47303
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVGHSA-2p3q-h3hg-jcqq 8.8

Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An elevation of privilege vulnerability exists in the ASP.NET Core Negotiate authentication handler in .NET 8, .NET 9, and .NET 10 due to improper parsing.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 8.8
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Weakness: CWE-302 (Authentication Bypass by Assumed-Immutable Data), CWE-863 (Incorrect Authorization), CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))

Affected Platforms

  • Platforms: All
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

<a name=".NET 10"></a>.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 10.0.0, <= 10.0.9 | 10.0.10

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 9.0.0, <= 9.0.17 | 9.0.18

<a name=".NET 8"></a>.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Authentication.Negotiate | >= 8.0.0, <= 8.0.28 | 8.0.29

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

  1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
  2. If your application references the vulnerable nuget package, update the package reference to the patched version. You can list the versions you have installed by running the dotnet --info command.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin…

Record
GHSA-2p3q-h3hg-jcqq
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-302, CWE-863, CWE-90
Updated
2026-11-02
Show 38 moreShow less
OSVRHSA-2026:26638 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:26638
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:39952 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:39952
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41893 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:41893
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41894 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:41894
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41895 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:41895
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41896 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:41896
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41897 8.8

Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Record
RHSA-2026:41897
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41898 8.8

Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Record
RHSA-2026:41898
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41899 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:41899
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41900 8.8

Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Record
RHSA-2026:41900
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41901 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:41901
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:42145 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:42145
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58566 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:58566
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58567 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:58567
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58568 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:58568
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58569 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:58569
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58570 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:58570
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41893 8.8

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-10.2.z] (JIRA:Rocky Linux-192468)

  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41893
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41894 8.8

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-9.8.z] (JIRA:Rocky Linux-192467)

  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192337)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41894
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41895 8.8

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-10.2.z] (JIRA:Rocky Linux-192473)

  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41895
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41896 8.8

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-9.8.z] (JIRA:Rocky Linux-192472)

  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192338)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41896
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41897 8.8

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-10.2.z] (JIRA:Rocky Linux-192463)

  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41897
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41898 8.8

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-9.8.z] (JIRA:Rocky Linux-192462)

  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192336)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41898
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41899 8.8

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 (JIRA:Rocky Linux-192469)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41899
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41900 8.8

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:Rocky Linux-192459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41900
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41901 8.8

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 (JIRA:Rocky Linux-192464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41901
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-47303 8.8

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Record
UBUNTU-CVE-2026-47303
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:41893 No score

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468)
  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41893
Updated
2026-11-02
OSVALSA-2026:41894 No score

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-9.8.z] (JIRA:AlmaLinux-192467)
  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192337)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41894
Updated
2026-11-02
OSVALSA-2026:41895 No score

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473)
  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41895
Updated
2026-11-02
OSVALSA-2026:41896 No score

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-9.8.z] (JIRA:AlmaLinux-192472)
  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192338)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41896
Updated
2026-11-02
OSVALSA-2026:41897 No score

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463)
  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41897
Updated
2026-11-02
OSVALSA-2026:41898 No score

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-9.8.z] (JIRA:AlmaLinux-192462)
  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192336)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41898
Updated
2026-11-02
OSVALSA-2026:41899 No score

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 (JIRA:AlmaLinux-192469)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41899
Updated
2026-11-02
OSVALSA-2026:41900 No score

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:AlmaLinux-192459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41900
Updated
2026-11-02
OSVALSA-2026:41901 No score

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 (JIRA:AlmaLinux-192464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41901
Updated
2026-11-02
OSVBIT-dotnet-2026-47303 No score

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Record
BIT-dotnet-2026-47303
Updated
2026-11-02
OSVBIT-dotnet-sdk-2026-47303 No score

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Record
BIT-dotnet-sdk-2026-47303
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
Microsoft.AspNetCore.Authentication.Negotiate
NuGet
 10.0.0 to 10.0.9
10.0.10
Microsoft.AspNetCore.Authentication.Negotiate
NuGet
 9.0.0 to 9.0.17
9.0.18
Microsoft.AspNetCore.Authentication.Negotiate
NuGet
 8.0.0 to 8.0.28
8.0.29
dotnet10-runtime
Alpine:v3.23
 before 10.0.10-r0
10.0.10-r0
dotnet10-runtime
Alpine:v3.24
 before 10.0.10-r0
10.0.10-r0
dotnet8-runtime
Alpine:v3.22
 before 8.0.29-r0
8.0.29-r0
dotnet8-runtime
Alpine:v3.23
 before 8.0.29-r0
8.0.29-r0
dotnet8-runtime
Alpine:v3.24
 before 8.0.29-r0
8.0.29-r0
dotnet9-runtime
Alpine:v3.22
 before 9.0.18-r0
9.0.18-r0
dotnet9-runtime
Alpine:v3.23
 before 9.0.18-r0
9.0.18-r0
Show 290 moreShow less
Affected packages
PackageAffectedFixed
dotnet9-runtime
Alpine:v3.24
 before 9.0.18-r0
9.0.18-r0
aspnetcore-runtime-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
aspnetcore-runtime-dbg-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
aspnetcore-targeting-pack-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-apphost-pack-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-hostfxr-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-runtime-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-runtime-dbg-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-sdk-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
dotnet-sdk-dbg-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
dotnet-targeting-pack-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-templates-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
aspnetcore-runtime-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
aspnetcore-runtime-dbg-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
aspnetcore-targeting-pack-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-apphost-pack-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-hostfxr-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-runtime-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-runtime-dbg-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-sdk-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
dotnet-sdk-dbg-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
dotnet-targeting-pack-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-templates-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
aspnetcore-runtime-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
aspnetcore-runtime-dbg-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
aspnetcore-targeting-pack-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-apphost-pack-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-hostfxr-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-runtime-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-runtime-dbg-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-sdk-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-sdk-aot-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-sdk-dbg-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-targeting-pack-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-templates-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
netstandard-targeting-pack-2.1
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
aspnetcore-runtime-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
aspnetcore-runtime-dbg-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
aspnetcore-targeting-pack-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-apphost-pack-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-hostfxr-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-runtime-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-runtime-dbg-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-sdk-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-sdk-aot-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-sdk-dbg-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-targeting-pack-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-templates-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
netstandard-targeting-pack-2.1
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
aspnetcore-runtime-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
aspnetcore-runtime-dbg-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
aspnetcore-targeting-pack-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-apphost-pack-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-host
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-hostfxr-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-runtime-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-runtime-dbg-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-sdk-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-sdk-aot-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-sdk-dbg-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-targeting-pack-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-templates-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
aspnetcore-runtime-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
aspnetcore-runtime-dbg-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
aspnetcore-targeting-pack-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-apphost-pack-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-host
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-hostfxr-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-runtime-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-runtime-dbg-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-sdk-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-sdk-aot-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-sdk-dbg-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-targeting-pack-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-templates-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
aspnetcore-runtime-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
aspnetcore-runtime-dbg-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
aspnetcore-targeting-pack-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-apphost-pack-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-hostfxr-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-runtime-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-runtime-dbg-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-sdk-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-sdk-aot-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-sdk-dbg-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-targeting-pack-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-templates-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
netstandard-targeting-pack-2.1
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
aspnetcore-runtime-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
aspnetcore-runtime-dbg-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
aspnetcore-targeting-pack-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-apphost-pack-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-host
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-hostfxr-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-runtime-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-runtime-dbg-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-sdk-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-sdk-aot-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-sdk-dbg-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-targeting-pack-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-templates-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
aspnetcore-runtime-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
aspnetcore-runtime-dbg-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
aspnetcore-targeting-pack-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-apphost-pack-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-hostfxr-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-runtime-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-runtime-dbg-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-sdk-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet-sdk-dbg-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet-targeting-pack-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-templates-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet
Bitnami
 8.0.0 up to 8.0.29, 9.0.0 up to 9.0.18, 10.0.0 up to 10.0.6
8.0.299.0.1810.0.6
dotnet-sdk
Bitnami
 8.0.0 up to 8.0.29, 9.0.0 up to 9.0.18, 10.0.0 up to 10.0.6
8.0.299.0.1810.0.6
Microsoft.AspNetCore.Authentication.Negotiate
NuGet
 10.0.0 up to 10.0.10, plus listed versions
10.0.110.0.210.0.310.0.410.0.5
Show 4 moreShow less
10.0.610.0.710.0.810.0.9
10.0.10
Microsoft.AspNetCore.Authentication.Negotiate
NuGet
 9.0.0 up to 9.0.18, plus listed versions
9.0.19.0.109.0.119.0.129.0.13
Show 12 moreShow less
9.0.149.0.159.0.169.0.179.0.29.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.18
Microsoft.AspNetCore.Authentication.Negotiate
NuGet
 8.0.0 up to 8.0.29, plus listed versions
8.0.18.0.108.0.118.0.128.0.13
Show 22 moreShow less
8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.38.0.48.0.58.0.68.0.78.0.8
8.0.29
dotnet-sdk-10.0
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:10.0.109-1.hum1
0:10.0.109-1.hum1
dotnet-sdk-10.0-source-built-artifacts
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:10.0.109-1.hum1
0:10.0.109-1.hum1
dotnet-sdk-aot-10.0
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:10.0.109-1.hum1
0:10.0.109-1.hum1
dotnet-sdk-dbg-10.0
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:10.0.109-1.hum1
0:10.0.109-1.hum1
dotnet-templates-10.0
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:10.0.109-1.hum1
0:10.0.109-1.hum1
dotnet10.0
Red Hat:hummingbird:1
From an advisory covering 16 CVEs
 before 0:10.0.109-1.hum1
0:10.0.109-1.hum1
dotnet-sdk-9.0
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:9.0.119-1.hum1
0:9.0.119-1.hum1
dotnet-sdk-9.0-source-built-artifacts
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:9.0.119-1.hum1
0:9.0.119-1.hum1
dotnet-sdk-aot-9.0
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:9.0.119-1.hum1
0:9.0.119-1.hum1
dotnet-sdk-dbg-9.0
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:9.0.119-1.hum1
0:9.0.119-1.hum1
dotnet-templates-9.0
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:9.0.119-1.hum1
0:9.0.119-1.hum1
dotnet9.0
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:9.0.119-1.hum1
0:9.0.119-1.hum1
netstandard-targeting-pack-2.1
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:9.0.119-1.hum1
0:9.0.119-1.hum1
aspnetcore-runtime-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
aspnetcore-runtime-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
aspnetcore-targeting-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-apphost-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-hostfxr-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-runtime-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-runtime-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-sdk-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-sdk-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-targeting-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-templates-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet8.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-sdk-8.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
aspnetcore-runtime-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
aspnetcore-runtime-dbg-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
aspnetcore-targeting-pack-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-apphost-pack-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-hostfxr-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-dbg-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-sdk-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-sdk-dbg-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-targeting-pack-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-templates-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-sdk-8.0-source-built-artifacts
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
aspnetcore-runtime-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
aspnetcore-runtime-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
aspnetcore-targeting-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-apphost-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-hostfxr-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-runtime-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-runtime-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-sdk-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-aot-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-targeting-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-templates-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet9.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
netstandard-targeting-pack-2.1
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-9.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
aspnetcore-runtime-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
aspnetcore-runtime-dbg-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
aspnetcore-targeting-pack-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-apphost-pack-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-hostfxr-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-dbg-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-sdk-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-aot-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-dbg-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-targeting-pack-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-templates-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
netstandard-targeting-pack-2.1
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-9.0-source-built-artifacts
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
aspnetcore-runtime-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
aspnetcore-runtime-dbg-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
aspnetcore-targeting-pack-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-apphost-pack-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-apphost-pack-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-host
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-host-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-hostfxr-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-hostfxr-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-runtime-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-runtime-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-runtime-dbg-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-sdk-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-aot-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-aot-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-dbg-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-targeting-pack-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-templates-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet10.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-10.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
aspnetcore-runtime-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
aspnetcore-runtime-dbg-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
aspnetcore-targeting-pack-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-apphost-pack-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-apphost-pack-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-host
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-host-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-hostfxr-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-hostfxr-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-runtime-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-runtime-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-runtime-dbg-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-sdk-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-aot-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-aot-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-dbg-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-targeting-pack-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-templates-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet8.0
Rocky Linux:10
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet8.0
Rocky Linux:9
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet9.0
Rocky Linux:10
From an advisory covering 16 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet9.0
Rocky Linux:9
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet10.0
Rocky Linux:10
From an advisory covering 16 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet10.0
Rocky Linux:9
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet9.0
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el8_10
0:9.0.119-1.el8_10
dotnet10.0
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el8_10
0:10.0.110-1.el8_10
dotnet8.0
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el8_10
0:8.0.129-1.el8_10
dotnet6
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.0.108-0ubuntu1~22.04.16.0.109-0ubuntu1~22.04.16.0.110-0ubuntu1~22.04.16.0.111-0ubuntu1~22.04.16.0.113-0ubuntu1~22.04.1
Show 16 moreShow less
6.0.116-0ubuntu1~22.04.16.0.118-0ubuntu1~22.04.16.0.119-0ubuntu1~22.04.16.0.120-0ubuntu1~22.04.16.0.121-0ubuntu1~22.04.16.0.122-0ubuntu1~22.04.16.0.123-0ubuntu1~22.04.16.0.124-0ubuntu1~22.04.16.0.125-0ubuntu1~22.04.16.0.126-0ubuntu1~22.04.16.0.127-0ubuntu1~22.04.16.0.128-0ubuntu1~22.04.26.0.132-0ubuntu1~22.04.16.0.133-0ubuntu1~22.04.16.0.135-0ubuntu1~22.04.16.0.136-0ubuntu1~22.04.1
 None known
dotnet7
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1
Show 9 moreShow less
7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1
 None known
dotnet8
Ubuntu:22.04:LTS
 before 8.0.129-8.0.29-0ubuntu1~22.04.1, plus listed versions
8.0.102-8.0.2-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.28.0.105-8.0.5-0ubuntu1~22.04.18.0.107-8.0.7-0ubuntu1~22.04.1
Show 19 moreShow less
8.0.108-8.0.8-0ubuntu1~22.04.18.0.110-8.0.10-0ubuntu1~22.04.18.0.111-8.0.11-0ubuntu1~22.04.18.0.112-8.0.12-0ubuntu1~22.04.18.0.114-8.0.14-0ubuntu1~22.04.18.0.115-8.0.15-0ubuntu1~22.04.18.0.116-8.0.16-0ubuntu1~22.04.18.0.117-8.0.17-0ubuntu1~22.04.18.0.118-8.0.18-0ubuntu1~22.04.18.0.119-8.0.19-0ubuntu1~22.04.18.0.120-8.0.20-0ubuntu1~22.04.18.0.121-8.0.21-0ubuntu1~22.04.18.0.122-8.0.22-0ubuntu1~22.04.18.0.123-8.0.23-0ubuntu1~22.04.18.0.124-8.0.24-0ubuntu1~22.04.18.0.125-8.0.25-0ubuntu1~22.04.18.0.126-8.0.26-0ubuntu1~22.04.18.0.127-8.0.27-0ubuntu1~22.04.18.0.128-8.0.28-0ubuntu1~22.04.1
8.0.129-8.0.29-0ubuntu1~22.04.1
dotnet10
Ubuntu:24.04:LTS
 before 10.0.110-10.0.10-0ubuntu1~24.04.1, plus listed versions
10.0.100-10.0.0-0ubuntu1~24.04.110.0.101-10.0.1-0ubuntu1~24.04.210.0.103-10.0.3-0ubuntu1~24.04.110.0.104-10.0.4-0ubuntu1~24.04.110.0.105-10.0.5-0ubuntu1~24.04.1
Show 4 moreShow less
10.0.106-10.0.6-0ubuntu1~24.04.110.0.107-10.0.7-0ubuntu1~24.04.110.0.108-10.0.8-0ubuntu1~24.04.110.0.109-10.0.9-0ubuntu1~24.04.1
10.0.110-10.0.10-0ubuntu1~24.04.1
dotnet8
Ubuntu:24.04:LTS
 before 8.0.129-8.0.29-0ubuntu1~24.04.1, plus listed versions
8.0.100-8.0.0~rc1-0ubuntu18.0.100-8.0.0~rc2-0ubuntu18.0.100-8.0.0~rc2-0ubuntu28.0.100-8.0.0-0ubuntu18.0.100-8.0.0-0ubuntu2
Show 28 moreShow less
8.0.101-8.0.1-0ubuntu18.0.101-8.0.1-0ubuntu28.0.102-8.0.2-0ubuntu18.0.103-8.0.3-0ubuntu28.0.103-8.0.3-0ubuntu38.0.104-8.0.4-0ubuntu18.0.105-8.0.5-0ubuntu1~24.04.18.0.107-8.0.7-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.28.0.110-8.0.10-0ubuntu1~24.04.18.0.111-8.0.11-0ubuntu1~24.04.18.0.112-8.0.12-0ubuntu1~24.04.18.0.114-8.0.14-0ubuntu1~24.04.18.0.115-8.0.15-0ubuntu1~24.04.18.0.116-8.0.16-0ubuntu1~24.04.18.0.117-8.0.17-0ubuntu1~24.04.18.0.118-8.0.18-0ubuntu1~24.04.18.0.119-8.0.19-0ubuntu1~24.04.18.0.120-8.0.20-0ubuntu1~24.04.18.0.121-8.0.21-0ubuntu1~24.04.18.0.122-8.0.22-0ubuntu1~24.04.18.0.123-8.0.23-0ubuntu1~24.04.18.0.124-8.0.24-0ubuntu1~24.04.18.0.125-8.0.25-0ubuntu1~24.04.18.0.126-8.0.26-0ubuntu1~24.04.18.0.127-8.0.27-0ubuntu1~24.04.18.0.128-8.0.28-0ubuntu1~24.04.1
8.0.129-8.0.29-0ubuntu1~24.04.1
dotnet10
Ubuntu:26.04:LTS
 before 10.0.110-10.0.10-0ubuntu1~26.04.1, plus listed versions
10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu110.0.100-10.0.0-0ubuntu110.0.100-10.0.0-0ubuntu210.0.101-10.0.1-0ubuntu1
Show 9 moreShow less
10.0.101-10.0.1-0ubuntu210.0.101-10.0.1-0ubuntu310.0.102-10.0.2-0ubuntu110.0.103-10.0.3-0ubuntu110.0.104-10.0.4-0ubuntu110.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1~26.04.110.0.109-10.0.9-0ubuntu1~26.04.1
10.0.110-10.0.10-0ubuntu1~26.04.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
affected, aliases
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-47303 is a high vulnerability (CVSS 8.8) in Microsoft .net, published June 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in Microsoft.AspNetCore.Authentication.Negotiate 10.0.10.

References

Show 190 moreShow less
This page doesn't list everything

Left out here: 229 package rows and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open