Critical Security Update for .NET 9.0: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:41895: Important: .NET 9.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-9.0 versions < 9.0.18-1.el10_2. Fixed in 9.0.18-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a subset of the .NET framework APIs, several new APIs, and a Common Language Runtime (CLR) implementation. The recent vulnerabilities identified in .NET 9.0 could lead to severe security risks, including denial of service and privilege escalation, affecting the integrity and availability of applications built on this framework.
Vulnerability Detail
The vulnerabilities in .NET 9.0 stem from various issues, including improper resource allocation, type confusion, and incorrect authentication algorithms. These vulnerabilities can lead to denial of service attacks, privilege escalation, and even local code execution through deserialization of untrusted data. The most critical vulnerabilities include CVE-2026-50651, which allows for an HTTP/2 SETTINGS/PING ACK flood causing out-of-memory (OOM) conditions, and CVE-2026-57108, which enables denial of service via type confusion.
How To Fix
Minimum fixed version
9.0.18-1.el10_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the updates, consider implementing rate limiting on your applications to mitigate the impact of potential denial of service attacks. Additionally, review your authentication mechanisms to ensure they are robust against privilege escalation attempts.
Conclusion
The vulnerabilities identified in .NET 9.0 pose significant risks to applications built on this framework. It is crucial to update to the latest patched versions to ensure the security and stability of your applications. Implementing workarounds can provide temporary relief while waiting for updates.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
The vulnerabilities can lead to denial of service, privilege escalation, and local code execution, compromising the security and stability of applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerabilities are associated with multiple CVEs, including CVE-2026-50651, CVE-2026-57108, and CVE-2026-47300, among others.
Implementing rate limiting and reviewing authentication mechanisms can help mitigate the risks associated with these vulnerabilities.
Detailed information about the updates and vulnerabilities can be found on the official CVE pages and the AlmaLinux advisory.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
