Every CVE Search/ Get API key

CVE-2026-50649

.NET Remote Code Execution Vulnerability

7.8 HighFix available

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.02%Up 3.1 points since Jul 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.8

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
CVE-2026-50649
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2026-44399 7.8

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
EUVD-2026-44399
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Updated
2026-11-02
NVD 7.8

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
CVE-2026-50649
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVALPINE-CVE-2026-50649 7.8

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
ALPINE-CVE-2026-50649
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.8

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
CVE-2026-50649
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:27171 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:27171
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
Show 36 moreShow less
OSVRHSA-2026:41893 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:41893
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41894 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:41894
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41895 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:41895
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41896 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:41896
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41897 8.8

Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Record
RHSA-2026:41897
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41898 8.8

Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Record
RHSA-2026:41898
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41899 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:41899
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41900 8.8

Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Record
RHSA-2026:41900
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:41901 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:41901
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:42145 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:42145
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58566 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:58566
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58567 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:58567
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58568 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:58568
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58569 8.8

Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Record
RHSA-2026:58569
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:58570 8.8

Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Record
RHSA-2026:58570
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41893 8.8

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-10.2.z] (JIRA:Rocky Linux-192468)

  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41893
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41894 8.8

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-9.8.z] (JIRA:Rocky Linux-192467)

  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192337)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41894
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41895 8.8

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-10.2.z] (JIRA:Rocky Linux-192473)

  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41895
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41896 8.8

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-9.8.z] (JIRA:Rocky Linux-192472)

  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192338)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41896
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41897 8.8

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-10.2.z] (JIRA:Rocky Linux-192463)

  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41897
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41898 8.8

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-9.8.z] (JIRA:Rocky Linux-192462)

  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [rhel-9.8.z] (JIRA:Rocky Linux-192336)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41898
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41899 8.8

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 (JIRA:Rocky Linux-192469)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41899
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41900 8.8

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:Rocky Linux-192459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41900
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:41901 8.8

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 (JIRA:Rocky Linux-192464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:41901
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-50649 7.8

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
UBUNTU-CVE-2026-50649
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:41893 No score

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-10.2.z] (JIRA:AlmaLinux-192468)
  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41893
Updated
2026-11-02
OSVALSA-2026:41894 No score

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-9.8.z] (JIRA:AlmaLinux-192467)
  • dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192337)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41894
Updated
2026-11-02
OSVALSA-2026:41895 No score

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473)
  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41895
Updated
2026-11-02
OSVALSA-2026:41896 No score

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-9.8.z] (JIRA:AlmaLinux-192472)
  • dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192338)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41896
Updated
2026-11-02
OSVALSA-2026:41897 No score

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-10.2.z] (JIRA:AlmaLinux-192463)
  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41897
Updated
2026-11-02
OSVALSA-2026:41898 No score

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-9.8.z] (JIRA:AlmaLinux-192462)
  • dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192336)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41898
Updated
2026-11-02
OSVALSA-2026:41899 No score

Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 (JIRA:AlmaLinux-192469)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41899
Updated
2026-11-02
OSVALSA-2026:41900 No score

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:AlmaLinux-192459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41900
Updated
2026-11-02
OSVALSA-2026:41901 No score

Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

  • dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  • dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  • ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  • ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  • ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  • dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  • dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  • dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  • dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  • dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  • dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  • dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  • dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  • dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  • dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  • .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  • dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

  • Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 (JIRA:AlmaLinux-192464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:41901
Updated
2026-11-02
OSVBIT-dotnet-2026-50649 No score

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
BIT-dotnet-2026-50649
Updated
2026-11-02
OSVBIT-dotnet-sdk-2026-50649 No score

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Record
BIT-dotnet-sdk-2026-50649
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
dotnet10-runtime
Alpine:v3.23
 before 10.0.10-r0
10.0.10-r0
dotnet10-runtime
Alpine:v3.24
 before 10.0.10-r0
10.0.10-r0
dotnet8-runtime
Alpine:v3.22
 before 8.0.29-r0
8.0.29-r0
dotnet8-runtime
Alpine:v3.23
 before 8.0.29-r0
8.0.29-r0
dotnet8-runtime
Alpine:v3.24
 before 8.0.29-r0
8.0.29-r0
dotnet9-runtime
Alpine:v3.22
 before 9.0.18-r0
9.0.18-r0
dotnet9-runtime
Alpine:v3.23
 before 9.0.18-r0
9.0.18-r0
dotnet9-runtime
Alpine:v3.24
 before 9.0.18-r0
9.0.18-r0
aspnetcore-runtime-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
aspnetcore-runtime-dbg-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
Show 290 moreShow less
Affected packages
PackageAffectedFixed
aspnetcore-targeting-pack-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-apphost-pack-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-hostfxr-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-runtime-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-runtime-dbg-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-sdk-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
dotnet-sdk-dbg-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
dotnet-targeting-pack-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.29-1.el10_2
8.0.29-1.el10_2
dotnet-templates-8.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 8.0.129-1.el10_2
8.0.129-1.el10_2
aspnetcore-runtime-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
aspnetcore-runtime-dbg-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
aspnetcore-targeting-pack-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-apphost-pack-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-hostfxr-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-runtime-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-runtime-dbg-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-sdk-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
dotnet-sdk-dbg-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
dotnet-targeting-pack-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.29-1.el9_8
8.0.29-1.el9_8
dotnet-templates-8.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 8.0.129-1.el9_8
8.0.129-1.el9_8
aspnetcore-runtime-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
aspnetcore-runtime-dbg-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
aspnetcore-targeting-pack-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-apphost-pack-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-hostfxr-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-runtime-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-runtime-dbg-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-sdk-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-sdk-aot-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-sdk-dbg-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
dotnet-targeting-pack-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.18-1.el10_2
9.0.18-1.el10_2
dotnet-templates-9.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
netstandard-targeting-pack-2.1
AlmaLinux:10
From an advisory covering 17 CVEs
 before 9.0.119-1.el10_2
9.0.119-1.el10_2
aspnetcore-runtime-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
aspnetcore-runtime-dbg-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
aspnetcore-targeting-pack-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-apphost-pack-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-hostfxr-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-runtime-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-runtime-dbg-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-sdk-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-sdk-aot-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-sdk-dbg-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
dotnet-targeting-pack-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.18-1.el9_8
9.0.18-1.el9_8
dotnet-templates-9.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
netstandard-targeting-pack-2.1
AlmaLinux:9
From an advisory covering 17 CVEs
 before 9.0.119-1.el9_8
9.0.119-1.el9_8
aspnetcore-runtime-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
aspnetcore-runtime-dbg-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
aspnetcore-targeting-pack-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-apphost-pack-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-host
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-hostfxr-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-runtime-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-runtime-dbg-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-sdk-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-sdk-aot-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-sdk-dbg-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
dotnet-targeting-pack-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.10-1.el10_2
10.0.10-1.el10_2
dotnet-templates-10.0
AlmaLinux:10
From an advisory covering 17 CVEs
 before 10.0.110-1.el10_2
10.0.110-1.el10_2
aspnetcore-runtime-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
aspnetcore-runtime-dbg-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
aspnetcore-targeting-pack-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-apphost-pack-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-host
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-hostfxr-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-runtime-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-runtime-dbg-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-sdk-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-sdk-aot-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-sdk-dbg-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
dotnet-targeting-pack-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.10-1.el9_8
10.0.10-1.el9_8
dotnet-templates-10.0
AlmaLinux:9
From an advisory covering 17 CVEs
 before 10.0.110-1.el9_8
10.0.110-1.el9_8
aspnetcore-runtime-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
aspnetcore-runtime-dbg-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
aspnetcore-targeting-pack-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-apphost-pack-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-hostfxr-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-runtime-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-runtime-dbg-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-sdk-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-sdk-9.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-sdk-aot-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-sdk-dbg-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
dotnet-targeting-pack-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.18-1.el8_10
9.0.18-1.el8_10
dotnet-templates-9.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
netstandard-targeting-pack-2.1
AlmaLinux:8
From an advisory covering 17 CVEs
 before 9.0.119-1.el8_10
9.0.119-1.el8_10
aspnetcore-runtime-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
aspnetcore-runtime-dbg-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
aspnetcore-targeting-pack-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-apphost-pack-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-host
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-hostfxr-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-runtime-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-runtime-dbg-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-sdk-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-sdk-10.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-sdk-aot-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-sdk-dbg-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
dotnet-targeting-pack-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.10-1.el8_10
10.0.10-1.el8_10
dotnet-templates-10.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 10.0.110-1.el8_10
10.0.110-1.el8_10
aspnetcore-runtime-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
aspnetcore-runtime-dbg-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
aspnetcore-targeting-pack-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-apphost-pack-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-hostfxr-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-runtime-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-runtime-dbg-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-sdk-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet-sdk-8.0-source-built-artifacts
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet-sdk-dbg-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet-targeting-pack-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.29-1.el8_10
8.0.29-1.el8_10
dotnet-templates-8.0
AlmaLinux:8
From an advisory covering 17 CVEs
 before 8.0.129-1.el8_10
8.0.129-1.el8_10
dotnet
Bitnami
 8.0.0 up to 8.0.29, 9.0.0 up to 9.0.18
8.0.299.0.18
dotnet-sdk
Bitnami
 8.0.0 up to 8.0.29, 9.0.0 up to 9.0.18
8.0.299.0.18
dotnet-sdk-9.0
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:9.0.118-1.hum1
0:9.0.118-1.hum1
dotnet-sdk-9.0-source-built-artifacts
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:9.0.118-1.hum1
0:9.0.118-1.hum1
dotnet-sdk-aot-9.0
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:9.0.118-1.hum1
0:9.0.118-1.hum1
dotnet-sdk-dbg-9.0
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:9.0.118-1.hum1
0:9.0.118-1.hum1
dotnet-templates-9.0
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:9.0.118-1.hum1
0:9.0.118-1.hum1
dotnet9.0
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:9.0.118-1.hum1
0:9.0.118-1.hum1
netstandard-targeting-pack-2.1
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:9.0.118-1.hum1
0:9.0.118-1.hum1
aspnetcore-runtime-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
aspnetcore-runtime-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
aspnetcore-targeting-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-apphost-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-hostfxr-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-runtime-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-runtime-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-sdk-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-sdk-dbg-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-targeting-pack-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el10_2
0:8.0.29-1.el10_2
dotnet-templates-8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet8.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet8.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet-sdk-8.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
aspnetcore-runtime-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
aspnetcore-runtime-dbg-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
aspnetcore-targeting-pack-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-apphost-pack-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-hostfxr-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-dbg-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-sdk-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-sdk-dbg-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-targeting-pack-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-templates-8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-apphost-pack-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-hostfxr-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-runtime-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.29-1.el9_8
0:8.0.29-1.el9_8
dotnet-sdk-8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet-sdk-8.0-source-built-artifacts
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet8.0-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
aspnetcore-runtime-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
aspnetcore-runtime-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
aspnetcore-targeting-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-apphost-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-hostfxr-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-runtime-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-runtime-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-sdk-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-aot-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-dbg-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-targeting-pack-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el10_2
0:9.0.18-1.el10_2
dotnet-templates-9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet9.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet9.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
netstandard-targeting-pack-2.1
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet-sdk-9.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
aspnetcore-runtime-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
aspnetcore-runtime-dbg-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
aspnetcore-targeting-pack-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-apphost-pack-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-hostfxr-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-dbg-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-sdk-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-aot-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-dbg-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-targeting-pack-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-templates-9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
netstandard-targeting-pack-2.1
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-hostfxr-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-runtime-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el9_8
0:9.0.18-1.el9_8
dotnet-sdk-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-9.0-source-built-artifacts
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet-sdk-aot-9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet9.0-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
aspnetcore-runtime-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
aspnetcore-runtime-dbg-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
aspnetcore-targeting-pack-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-apphost-pack-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-apphost-pack-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-host
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-host-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-hostfxr-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-hostfxr-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-runtime-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-runtime-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-runtime-dbg-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-sdk-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-aot-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-aot-10.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-dbg-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-targeting-pack-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el10_2
0:10.0.10-1.el10_2
dotnet-templates-10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet10.0
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet10.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet-sdk-10.0-source-built-artifacts
Red Hat:enterprise_linux:10.2
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
aspnetcore-runtime-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
aspnetcore-runtime-dbg-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
aspnetcore-targeting-pack-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-apphost-pack-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-apphost-pack-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-host
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-host-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-hostfxr-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-hostfxr-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-runtime-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-runtime-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-runtime-dbg-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-sdk-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-aot-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-aot-10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-dbg-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-targeting-pack-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-templates-10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet10.0
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet10.0-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet10.0-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-apphost-pack-10.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-host-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-hostfxr-10.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-runtime-10.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.10-1.el9_8
0:10.0.10-1.el9_8
dotnet-sdk-10.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-10.0-source-built-artifacts
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet-sdk-aot-10.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet10.0-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet10.0-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
aspnetcore-runtime-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el8_10
0:9.0.18-1.el8_10
aspnetcore-runtime-dbg-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el8_10
0:9.0.18-1.el8_10
aspnetcore-targeting-pack-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el8_10
0:9.0.18-1.el8_10
dotnet-apphost-pack-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el8_10
0:9.0.18-1.el8_10
dotnet-apphost-pack-9.0-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el8_10
0:9.0.18-1.el8_10
dotnet-hostfxr-9.0
Red Hat:enterprise_linux:8::appstream
From an advisory covering 17 CVEs
 before 0:9.0.18-1.el8_10
0:9.0.18-1.el8_10
dotnet8.0
Rocky Linux:10
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el10_2
0:8.0.129-1.el10_2
dotnet8.0
Rocky Linux:9
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el9_8
0:8.0.129-1.el9_8
dotnet9.0
Rocky Linux:10
From an advisory covering 16 CVEs
 before 0:9.0.119-1.el10_2
0:9.0.119-1.el10_2
dotnet9.0
Rocky Linux:9
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el9_8
0:9.0.119-1.el9_8
dotnet10.0
Rocky Linux:10
From an advisory covering 16 CVEs
 before 0:10.0.110-1.el10_2
0:10.0.110-1.el10_2
dotnet10.0
Rocky Linux:9
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el9_8
0:10.0.110-1.el9_8
dotnet9.0
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:9.0.119-1.el8_10
0:9.0.119-1.el8_10
dotnet10.0
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:10.0.110-1.el8_10
0:10.0.110-1.el8_10
dotnet8.0
Rocky Linux:8
From an advisory covering 17 CVEs
 before 0:8.0.129-1.el8_10
0:8.0.129-1.el8_10
dotnet7
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1
Show 9 moreShow less
7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1
 None known

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-50649 is a high vulnerability (CVSS 7.8) in Microsoft .net, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.02%, the 90th percentile. Fixed in dotnet10-runtime 10.0.10-r0.

References

Show 173 moreShow less
This page doesn't list everything

Left out here: 212 package rows. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open