Critical Security Update for .NET 9.0: Addressing Denial of Service Vulnerabilities in ASP.NET Core
Summary
ALSA-2026:4450: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.14-1.el10_1. Fixed in 9.0.14-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a Common Language Runtime (CLR) and a rich set of APIs. The recent vulnerabilities discovered in .NET 9.0, specifically affecting ASP.NET Core, expose applications to potential Denial of Service (DoS) attacks, which can severely impact application availability and performance.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-26127 and CVE-2026-26130 allow attackers to exploit out-of-bounds reads and uncontrolled resource allocation, respectively. These issues can lead to Denial of Service conditions, where legitimate users are unable to access the application due to resource exhaustion or crashes. The vulnerabilities stem from improper handling of certain requests, making it critical for developers to address these issues promptly.
How To Fix
Minimum fixed version
9.0.14-1.el10_1
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on your application to reduce the impact of potential DoS attacks. This can help manage resource allocation and prevent exhaustion during an attack.
Conclusion
The vulnerabilities in .NET 9.0 pose significant risks to applications built on this framework. It is crucial to update to the latest patched versions of the affected packages to ensure the security and availability of your applications. Utilizing tools like Vulert can further enhance your ability to monitor and respond to vulnerabilities in real-time.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
The vulnerabilities allow for Denial of Service attacks through out-of-bounds reads and uncontrolled resource allocation.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Failure to address these vulnerabilities can lead to application downtime, loss of availability for users, and potential data loss.
Yes, you need to update the ASP.NET Core Runtime and .NET SDK to their respective patched versions.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. It helps developers stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
