Critical Security Update for .NET 8.0: Addressing Multiple Vulnerabilities
Summary
RLSA-2026:8470: Important: .NET 8.0 security update. Affects dotnet8.0 versions < 0:8.0.126-1.el10_1. Fixed in 0:8.0.126-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software environment that provides a comprehensive platform for building and running applications. It includes a subset of the .NET framework APIs, several new APIs, and a Common Language Runtime (CLR) implementation. The framework is widely used for developing web, desktop, and mobile applications. However, recent vulnerabilities have been identified in .NET 8.0, specifically affecting versions prior to 8.0.126.
Vulnerability Detail
The vulnerabilities in .NET 8.0 include a security bypass and denial of service (CVE-2026-26171), denial of service via stack overflow (CVE-2026-32203), denial of service via infinite recursion in XmlDecryptionTransform (CVE-2026-33116), and SMTP command injection and header injection via MailAddress parsing flaw (CVE-2026-32178). These vulnerabilities could allow attackers to exploit the framework, potentially leading to service disruptions or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
0:8.0.126-1.el10_1
This is the first release that contains the fix.
sudo dnf update dotnet8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation and sanitization in your application to reduce the risk of exploitation until the package is updated. This includes checking and cleaning user inputs before processing them.
Conclusion
In summary, the recent vulnerabilities identified in .NET 8.0 pose significant risks to applications built on this framework. It is crucial to update to the latest patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for dotnet8.0 →
FAQ
The CVSS score of the vulnerabilities is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The vulnerabilities could lead to denial of service attacks, unauthorized access, and potential data breaches, affecting the integrity and availability of your applications.
Yes, you should update to .NET SDK 8.0.126 or .NET Runtime 8.0.26 to ensure that the vulnerabilities are patched.
If immediate updates are not possible, implement input validation and sanitization as a temporary workaround to minimize risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for dotnet8.0.
