Critical Security Update for .NET 9.0: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:4456: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.14-1.el9_7. Fixed in 9.0.14-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a set of APIs and a Common Language Runtime (CLR) that enables developers to create applications in various programming languages. The recent vulnerabilities identified in .NET 9.0, specifically in the ASP.NET Core component, expose applications to potential Denial of Service (DoS) attacks, which can disrupt service availability and degrade user experience.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-26127 and CVE-2026-26130 allow attackers to exploit out-of-bounds reads and uncontrolled resource allocation, respectively. These issues can lead to Denial of Service conditions, where legitimate users are unable to access the application due to resource exhaustion or crashes. The vulnerabilities stem from improper handling of certain inputs and resource management within the framework, making it critical for users to apply the necessary updates to mitigate these risks.
How To Fix
Minimum fixed version
9.0.14-1.el9_7
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the resources allocated to the application or implementing rate limiting to mitigate the impact of potential DoS attacks until the updates can be applied. Additionally, monitoring application logs for unusual activity can help identify potential exploitation attempts.
Conclusion
The recent vulnerabilities in .NET 9.0 pose significant risks to application availability through Denial of Service attacks. It is crucial for developers and system administrators to apply the recommended updates to mitigate these vulnerabilities and ensure the security and reliability of their applications.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
The vulnerabilities are CVE-2026-26127, which involves a Denial of Service via out-of-bounds read, and CVE-2026-26130, which involves Denial of Service via uncontrolled resource allocation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, consider implementing rate limiting and monitoring application logs for unusual activity to mitigate potential exploitation.
The vulnerabilities can lead to Denial of Service conditions, making applications unavailable to legitimate users and potentially causing significant disruptions.
For detailed information, refer to the CVE pages for CVE-2026-26127 and CVE-2026-26130, which provide insights into the vulnerabilities and their implications.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
