Critical Security Update for .NET 9.0: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:4443: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.14-1.el8_10. Fixed in 9.0.14-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a set of APIs and a Common Language Runtime (CLR) for executing code. The recent vulnerabilities identified in .NET 9.0 could lead to significant security risks, particularly in web applications using ASP.NET Core, which is part of the .NET ecosystem.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-26127 and CVE-2026-26130 expose .NET 9.0 to Denial of Service (DoS) attacks. The first vulnerability allows attackers to exploit out-of-bounds read conditions, potentially leading to application crashes or unexpected behavior. The second vulnerability in ASP.NET Core involves uncontrolled resource allocation, which can result in resource exhaustion, causing the application to become unresponsive. These vulnerabilities can severely impact application availability and reliability.
How To Fix
Minimum fixed version
9.0.14-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing rate limiting and resource management strategies in your application to mitigate the impact of potential DoS attacks. This can help control the resource usage and maintain application availability until the updates are applied.
Conclusion
The recent vulnerabilities in .NET 9.0 pose significant risks, particularly for applications using ASP.NET Core. It is crucial to update to the latest patched versions to ensure security and maintain application availability. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
The vulnerabilities are related to Denial of Service attacks, which can cause applications to crash or become unresponsive.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Failure to address these vulnerabilities can lead to application downtime, resource exhaustion, and potential data loss.
Yes, the vulnerabilities specifically affect .NET SDK 9.0.115 and .NET Runtime 9.0.14 and earlier versions.
Implementing rate limiting and resource management can help mitigate the impact of the vulnerabilities until updates are applied.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
