Critical Vulnerability in .NET 9.0: Multiple Security Flaws and Denial of Service Risks
Summary
RLSA-2026:41895: Important: .NET 9.0 security, bug fix, and enhancement update. Affects dotnet9.0 versions < 0:9.0.119-1.el10_2. Fixed in 0:9.0.119-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
.NET is a managed-software framework that provides a comprehensive programming model for building applications. It implements a subset of the .NET framework APIs and introduces several new APIs, along with a Common Language Runtime (CLR) implementation. The recent vulnerabilities in .NET 9.0 highlight significant security concerns, including denial of service and privilege escalation, which could severely impact applications relying on this framework.
Vulnerability Detail
The vulnerabilities in .NET 9.0 arise from various issues, including a denial of service via uncontrolled resource allocation, privilege escalation due to incorrect authentication algorithms, and local code execution vulnerabilities stemming from deserialization of untrusted data. These vulnerabilities can lead to severe ramifications, such as unauthorized access, application crashes, and potential data breaches. The CVSS score for these vulnerabilities is 8.8, indicating a high level of risk.
How To Fix
Minimum fixed version
0:9.0.119-1.el10_2
This is the first release that contains the fix.
sudo dnf update dotnet9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing strict input validation and limiting resource allocation to mitigate the risk of denial of service attacks. Additionally, review authentication mechanisms to ensure they are robust against privilege escalation attempts.
Conclusion
The vulnerabilities in .NET 9.0 present significant risks that can lead to denial of service, privilege escalation, and local code execution. It is essential to update to the latest patched versions to safeguard applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for dotnet9.0 →
FAQ
The vulnerabilities include denial of service, privilege escalation, and local code execution risks, primarily due to improper resource management and authentication flaws.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score for the vulnerabilities in .NET 9.0 is 8.8, indicating a high severity level.
Implement strict input validation and limit resource allocation to reduce the risk of denial of service attacks while planning for an update.
Detailed information about the vulnerabilities, including their impact and technical details, can be found on the CVE pages associated with each identified issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for dotnet9.0.
