Critical Security Update for .NET 10.0: Denial of Service Vulnerability in aspnetcore-runtime
Summary
ALSA-2026:21295: Important: .NET 10.0 security update. Affects aspnetcore-runtime-10.0 versions < 10.0.8-1.el8_10. Fixed in 10.0.8-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a variety of APIs and a Common Language Runtime (CLR) that enables developers to create applications in multiple programming languages. The aspnetcore-runtime package is essential for running ASP.NET Core applications, providing the necessary runtime components. This package, along with others in the .NET ecosystem, has been identified as vulnerable to a denial of service attack due to an infinite loop issue.
Vulnerability Detail
The vulnerability, identified as CVE-2026-42899, allows an attacker to exploit an infinite loop in the .NET framework, potentially leading to a denial of service. This means that an attacker could craft specific inputs that cause the application to enter an endless loop, consuming system resources and making the application unresponsive. The issue arises from the way certain APIs handle input, and if left unaddressed, it could lead to significant downtime and service disruption for applications relying on the affected packages.
How To Fix
Minimum fixed version
10.0.8-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing input validation to prevent untrusted data from being processed by the application. This can help mitigate the risk of triggering the infinite loop until the packages are updated.
Conclusion
The .NET 10.0 security update addresses a critical denial of service vulnerability that could severely impact applications using the affected packages. It is crucial for developers and system administrators to update their systems promptly to the patched versions to ensure continued security and functionality.
See every vulnerability recorded for aspnetcore-runtime-10.0 →
FAQ
CVE-2026-42899 is a vulnerability in the .NET framework that allows an attacker to cause a denial of service through an infinite loop.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to application downtime, unresponsiveness, and potential loss of service for users.
Yes, patched versions of the affected packages are available. Updating to the specified versions will resolve the vulnerability.
Implement input validation as a temporary workaround to mitigate the risk of exploitation until you can apply the updates.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-10.0.
