Critical Security Update for .NET 8.0: Addressing Local File Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:25110: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.28-1.el8_10. Fixed in 8.0.28-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a variety of APIs and a Common Language Runtime (CLR) that allows developers to create robust applications across different platforms. The recent vulnerabilities identified in .NET 8.0 could potentially compromise application integrity and availability, making it crucial for users to address these issues promptly.
Vulnerability Detail
The vulnerabilities in .NET 8.0 include a local file tampering issue due to improper link following (CVE-2026-45491) and a denial of service vulnerability caused by uncontrolled resource consumption (CVE-2026-45591). These vulnerabilities can allow attackers to manipulate files on the system or exhaust system resources, leading to application downtime and potential data loss.
How To Fix
Minimum fixed version
8.0.28-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the resources allocated to applications using .NET 8.0 to mitigate the denial of service risk. This can be done by configuring resource limits in the application settings or using container orchestration tools to manage resource allocation.
Conclusion
The vulnerabilities identified in .NET 8.0 pose significant risks to application security and availability. It is essential for users to update their packages to the latest versions to protect against local file tampering and denial of service attacks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
The vulnerabilities involve local file tampering and denial of service, which can lead to unauthorized file access and application downtime.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Failure to address these vulnerabilities can result in unauthorized access to files and potential service outages, impacting application reliability and user trust.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to compromise system integrity.
If immediate updates are not possible, consider implementing resource limits and monitoring application performance closely to mitigate potential impacts.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
