Critical Security Update for .NET 10.0: Addressing Local File Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:25114: Important: .NET 10.0 security update. Affects aspnetcore-runtime-10.0 versions < 10.0.9-1.el8_10. Fixed in 10.0.9-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a set of APIs and a Common Language Runtime (CLR) that enables developers to create applications in various programming languages. The recent vulnerabilities identified in .NET 10.0 can lead to significant security risks, including unauthorized file access and denial of service attacks, making it crucial for users to update to the latest versions.
Vulnerability Detail
The vulnerabilities in .NET 10.0 stem from two main issues: a local file tampering vulnerability (CVE-2026-45491) that allows attackers to manipulate files through link following, and a denial of service vulnerability (CVE-2026-45591) that can be exploited through uncontrolled resource consumption. These vulnerabilities can lead to unauthorized access to sensitive data and service disruptions, posing serious risks to applications built on this framework.
How To Fix
Minimum fixed version
10.0.9-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected applications and monitor for unusual activity until the updates are applied. Implementing strict file permissions and resource usage limits can also help mitigate the risks associated with these vulnerabilities.
Conclusion
The vulnerabilities identified in .NET 10.0 pose significant risks to applications built on this framework. By updating to the latest patched versions and implementing recommended workarounds, users can protect their applications from potential attacks. Regular monitoring and updates are essential to maintaining security.
See every vulnerability recorded for aspnetcore-runtime-10.0 →
FAQ
This vulnerability allows attackers to manipulate files by exploiting link following, potentially leading to unauthorized access to sensitive information.
Denial of service attacks can overwhelm your application by consuming excessive resources, leading to service outages and degraded performance.
While specific exploits may not be publicly available, the nature of these vulnerabilities makes them attractive targets for attackers.
It is recommended to regularly check for updates and apply them promptly to ensure your applications are protected against known vulnerabilities.
Yes, Vulert can monitor your applications for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. You can check your application's status using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-10.0.
