Critical Security Update for .NET 9.0: Addressing Denial of Service Vulnerability
Summary
ALSA-2026:21296: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.16-1.el9_8. Fixed in 9.0.16-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software environment that provides a comprehensive set of APIs for building applications. It includes a Common Language Runtime (CLR) implementation and supports various programming languages. The recent versions of .NET, specifically .NET SDK 9.0.117 and .NET Runtime 9.0.16, have been released to address a critical security vulnerability that could potentially lead to denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2026-42899 allows an attacker to exploit an infinite loop within the .NET framework, which can lead to a denial of service. This means that an attacker could potentially cause the application to become unresponsive, affecting its availability and functionality. The issue arises from improper handling of certain inputs, leading to resource exhaustion and application crashes.
How To Fix
Minimum fixed version
9.0.16-1.el9_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate updating is not possible, consider limiting the input that can trigger the infinite loop or implementing additional validation checks to mitigate the risk of denial of service until the update can be applied.
Conclusion
The .NET 9.0 security update addresses a critical vulnerability that could lead to denial of service attacks. It is crucial for users to update their packages to the latest versions to ensure the security and availability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
CVE-2026-42899 is a security vulnerability in the .NET framework that allows for denial of service due to an infinite loop.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application unavailability, causing significant disruptions in service.
Yes, the patched versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16. It is recommended to update to these versions.
If immediate updates are not feasible, consider implementing input validation to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
