Critical Security Update: .NET 10.0 Vulnerabilities in ASP.NET Core and Runtime Packages
Summary
ALSA-2026:25222: Important: .NET 10.0 security update. Affects aspnetcore-runtime-10.0 versions < 10.0.9-1.el9_8. Fixed in 10.0.9-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a set of APIs and a Common Language Runtime (CLR) that allows developers to create applications in various programming languages. The ASP.NET Core package is a key component of this framework, enabling the development of web applications and services. Recent vulnerabilities have been identified in .NET 10.0, specifically affecting the ASP.NET Core runtime and related packages, which could lead to severe security risks if not addressed promptly.
Vulnerability Detail
The identified vulnerabilities include a local file tampering issue via link following (CVE-2026-45491) and a denial of service vulnerability due to uncontrolled resource consumption (CVE-2026-45591). These vulnerabilities could allow an attacker to manipulate files on the system or exhaust resources, potentially leading to application downtime or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
10.0.9-1.el9_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of your application by implementing strict input validation and resource management to mitigate the impact of the denial of service vulnerability until the patches are applied.
Conclusion
The vulnerabilities identified in .NET 10.0 pose significant risks to applications utilizing the ASP.NET Core and related packages. It is imperative to apply the necessary updates to mitigate these risks and ensure the security of your applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for aspnetcore-runtime-10.0 →
FAQ
The main vulnerabilities are a local file tampering issue and a denial of service vulnerability affecting ASP.NET Core and related packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check your application without any signup.
If immediate updates are not possible, implement strict input validation and resource management as a temporary workaround to reduce the risk.
While specific exploits have not been publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to manipulate files or exhaust system resources.
For detailed information, refer to the CVE pages for CVE-2026-45491 and CVE-2026-45591, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-10.0.
