Critical Security Update for .NET 10.0: Addressing Local File Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:25115: Important: .NET 10.0 security update. Affects aspnetcore-runtime-10.0 versions < 10.0.9-1.el10_2. Fixed in 10.0.9-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a subset of APIs from the .NET framework along with several new APIs and a Common Language Runtime (CLR) implementation. The framework is widely used for developing web applications, services, and desktop applications. However, recent vulnerabilities have been identified in .NET 10.0, specifically affecting the ASP.NET Core runtime and SDK, which could lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified in .NET 10.0 include a local file tampering issue via link following (CVE-2026-45491) and a denial of service (DoS) vulnerability due to uncontrolled resource consumption (CVE-2026-45591). The local file tampering vulnerability allows an attacker to manipulate files on the local system by exploiting improper handling of links. The DoS vulnerability can lead to service outages by exhausting system resources, making the application unresponsive. Both vulnerabilities pose significant risks to application integrity and availability.
How To Fix
Minimum fixed version
10.0.9-1.el10_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit access to the affected services and monitor resource usage to mitigate the impact of the denial of service vulnerability. Implementing rate limiting and resource quotas can help manage resource consumption until the update is applied.
Conclusion
The recent vulnerabilities in .NET 10.0 highlight the importance of maintaining up-to-date software to protect against potential security threats. By updating to the latest patched versions and implementing recommended workarounds, developers can safeguard their applications and ensure continued reliability.
See every vulnerability recorded for aspnetcore-runtime-10.0 →
FAQ
The vulnerabilities include local file tampering and denial of service, which can compromise application integrity and availability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring access to the code.
Failure to address these vulnerabilities can lead to unauthorized file access, data manipulation, and service outages, impacting user trust and application reliability.
While specific exploits may not be publicly available, the nature of the vulnerabilities makes them attractive targets for attackers, emphasizing the need for prompt remediation.
It is advisable to regularly check for updates and apply security patches as soon as they are released to minimize the risk of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-10.0.
