Critical Security Update for .NET 9.0: Addressing Spoofing Vulnerability in AspNetCore and DotNet Packages
Summary
ALSA-2025:7571: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.5-1.el8_10. Fixed in 9.0.5-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a subset of the .NET framework APIs along with several new APIs, and features a Common Language Runtime (CLR) implementation. The recent versions of .NET, specifically .NET SDK 9.0.106 and .NET Runtime 9.0.5, have been released to address a critical security vulnerability that could potentially impact applications relying on these packages.
Vulnerability Detail
The vulnerability identified as CVE-2025-26646 is a spoofing vulnerability affecting .NET and Visual Studio. This vulnerability could allow an attacker to impersonate a legitimate user or service, potentially leading to unauthorized access or manipulation of sensitive data. The issue arises from improper validation of user input, which can be exploited to execute malicious actions within the application context.
How To Fix
Minimum fixed version
9.0.5-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization measures to mitigate the risk of exploitation. Additionally, limit access to sensitive functionalities until the update can be applied.
Conclusion
The .NET 9.0 security update addresses a critical spoofing vulnerability that can significantly impact applications. It is crucial to update the affected packages to their patched versions to ensure the security and integrity of your applications. Regular monitoring and timely updates are essential in maintaining a secure software environment.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
CVE-2025-26646 is a spoofing vulnerability in .NET and Visual Studio that allows attackers to impersonate legitimate users or services.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Failure to address this vulnerability may lead to unauthorized access, data manipulation, and potential breaches of sensitive information.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
Vulert is a tool that monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time alerts.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
