RLSA-2026:41895

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

• dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

• dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

• ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

• ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

• ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

• dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

• dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

• dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

• dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

• dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

• dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

• dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

• dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

• .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

• dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-10.2.z] (JIRA:Rocky Linux-192473)

• dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s)...