Critical Security Update for .NET 8.0: Addressing Local File Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:25220: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.28-1.el9_8. Fixed in 8.0.28-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a set of APIs and a Common Language Runtime (CLR) that allows developers to create applications in various programming languages. The recent vulnerabilities discovered in .NET 8.0, specifically in the ASP.NET Core and related packages, pose significant risks to application security and stability.
Vulnerability Detail
The vulnerabilities identified in .NET 8.0 include a local file tampering issue due to link following (CVE-2026-45491) and a denial of service vulnerability caused by uncontrolled resource consumption (CVE-2026-45591). These vulnerabilities can lead to unauthorized access to sensitive files and potential service disruptions, impacting the availability and integrity of applications built on this framework.
How To Fix
Minimum fixed version
8.0.28-1.el9_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing strict access controls on file permissions and monitoring resource usage to mitigate the impact of these vulnerabilities until a proper fix can be applied.
Conclusion
The recent vulnerabilities in .NET 8.0 highlight the importance of timely updates and security practices in software development. By addressing these vulnerabilities through updates and implementing necessary workarounds, developers can ensure the security and stability of their applications.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
The vulnerabilities involve local file tampering and denial of service due to uncontrolled resource consumption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address these vulnerabilities can lead to unauthorized access to sensitive files and potential service outages.
Yes, the vulnerabilities affect .NET SDK 8.0.128 and .NET Runtime 8.0.28 on AlmaLinux 9.
Update the affected packages to their patched versions and implement access controls and monitoring as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
