Critical Security Update for .NET 8.0: Addressing Local File Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:25111: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.28-1.el10_2. Fixed in 8.0.28-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software environment that provides a comprehensive platform for building and running applications. It includes a variety of APIs and a Common Language Runtime (CLR) for executing code. The recent vulnerabilities identified in .NET 8.0, specifically in the ASP.NET Core runtime, pose significant risks to applications relying on this framework, potentially leading to unauthorized access and service disruptions.
Vulnerability Detail
The vulnerabilities in .NET 8.0 stem from two critical issues: a local file tampering vulnerability (CVE-2026-45491) that allows attackers to manipulate files through link following, and a denial of service vulnerability (CVE-2026-45591) that can lead to uncontrolled resource consumption. These vulnerabilities can be exploited to compromise the integrity of applications and disrupt service availability, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
8.0.28-1.el10_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected components of their applications and monitor for unusual activity. However, the best course of action is to apply the updates as soon as possible to fully resolve the vulnerabilities.
Conclusion
The vulnerabilities identified in .NET 8.0 present serious risks that can lead to unauthorized access and service disruptions. It is crucial for users to update their packages to the latest versions to ensure the security and integrity of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
The main vulnerabilities are a local file tampering issue and a denial of service vulnerability, which can compromise application integrity and availability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The patched versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.
If immediate updates are not possible, consider implementing access restrictions and monitoring for suspicious activity as a temporary workaround.
For detailed information, refer to the CVE pages for CVE-2026-45491 and CVE-2026-45591.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
