Critical Denial of Service Vulnerability in .NET 10.0 Packages
Summary
ALSA-2026:21297: Important: .NET 10.0 security update. Affects aspnetcore-runtime-10.0 versions < 10.0.8-1.el9_8. Fixed in 10.0.8-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The .NET framework is a managed-software framework that provides a comprehensive programming model for building applications. It includes a subset of the .NET framework APIs along with several new APIs, and features a Common Language Runtime (CLR) implementation. The affected packages, including aspnetcore-runtime, dotnet-sdk, and others, are essential for developing and running .NET applications. The recent security update addresses a critical vulnerability that could lead to a denial of service, impacting the availability of applications built on this framework.
Vulnerability Detail
The vulnerability identified as CVE-2026-42899 allows an attacker to exploit an infinite loop in the .NET framework, which can lead to a denial of service. This means that an attacker could potentially cause the application to become unresponsive, affecting its availability and functionality. The issue originates from the way certain APIs handle specific inputs, leading to resource exhaustion. The ramifications of this vulnerability can be severe, especially for applications that rely heavily on the .NET framework for their operations.
How To Fix
Minimum fixed version
10.0.8-1.el9_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the input to the affected APIs to prevent exploitation until the packages can be updated. Implementing rate limiting on requests to the application may also help mitigate the risk of denial of service attacks.
Conclusion
The recent security update for .NET 10.0 packages addresses a critical vulnerability that could lead to denial of service attacks. It is crucial for developers and system administrators to update their packages to the patched versions to ensure the security and availability of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for aspnetcore-runtime-10.0 →
FAQ
CVE-2026-42899 is a vulnerability in the .NET framework that allows an attacker to exploit an infinite loop, potentially leading to a denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
The primary consequence is a denial of service, where the application may become unresponsive, affecting its availability and user experience.
While specific exploits may not be publicly available, the nature of the vulnerability allows for potential exploitation by attackers familiar with the .NET framework.
It is recommended to regularly check for updates and apply security patches as soon as they are released to mitigate vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-10.0.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
