Critical Security Update for .NET 9.0: Addressing Local File Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:25112: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.17-1.el10_2. Fixed in 9.0.17-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a variety of APIs and a Common Language Runtime (CLR) that allows developers to create applications in multiple programming languages. The recent vulnerabilities identified in .NET 9.0 could potentially compromise the integrity and availability of applications built on this framework, making it crucial for users to stay updated with the latest security patches.
Vulnerability Detail
The vulnerabilities in .NET 9.0 include a local file tampering issue due to improper link following (CVE-2026-45491) and a denial of service vulnerability caused by uncontrolled resource consumption (CVE-2026-45591). These vulnerabilities can lead to unauthorized access to sensitive files and can cause applications to become unresponsive, respectively. It is essential for developers and system administrators to understand the implications of these vulnerabilities and take appropriate action to mitigate risks.
How To Fix
Minimum fixed version
9.0.17-1.el10_2
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their applications by implementing strict access controls and monitoring resource usage to prevent denial of service attacks. Additionally, avoid using features that may lead to local file tampering until the updates are applied.
Conclusion
The vulnerabilities identified in .NET 9.0 pose significant risks to applications built on this framework. It is imperative for users to update their packages to the latest versions to mitigate these risks. By following the recommended steps and utilizing tools like Vulert, developers can ensure their applications remain secure and resilient against potential threats.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
The local file tampering vulnerability allows attackers to manipulate files on the system, potentially leading to unauthorized access to sensitive data.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected.
Implement strict access controls and monitor resource usage as a temporary workaround until you can apply the necessary updates.
While specific exploits may not be publicly disclosed, the nature of these vulnerabilities suggests that they could be exploited by attackers to compromise application integrity and availability.
Detailed information can be found on the CVE pages for CVE-2026-45491 and CVE-2026-45591, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
