Critical Security Update for .NET 9.0 Packages: Addressing Local File Tampering and Denial of Service Vulnerabilities
Summary
ALSA-2026:25221: Important: .NET 9.0 security update. Affects aspnetcore-runtime-9.0 versions < 9.0.17-1.el9_8. Fixed in 9.0.17-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software framework that provides a comprehensive programming model for building applications. It includes a subset of the .NET framework APIs, several new APIs, and a Common Language Runtime (CLR) implementation. The affected packages, including aspnetcore-runtime-9.0 and dotnet-sdk-9.0, are essential for developing and running .NET applications. Recent vulnerabilities have been identified that could compromise the security and stability of applications built on this framework.
Vulnerability Detail
The vulnerabilities identified in .NET 9.0 include a local file tampering issue via link following (CVE-2026-45491) and a denial of service due to uncontrolled resource consumption (CVE-2026-45591). The local file tampering vulnerability allows an attacker to manipulate files on the local system, potentially leading to unauthorized access or data corruption. The denial of service vulnerability can cause applications to become unresponsive, affecting availability and user experience. Both vulnerabilities pose significant risks to applications relying on the affected .NET packages.
How To Fix
Minimum fixed version
9.0.17-1.el9_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict access controls and monitoring for unusual activity on applications using the affected packages. Additionally, limit the exposure of applications to untrusted inputs that could exploit these vulnerabilities.
Conclusion
The recent vulnerabilities in .NET 9.0 packages highlight the importance of maintaining up-to-date software to ensure security and stability. By promptly applying the necessary updates and following best practices, organizations can protect their applications from potential threats.
See every vulnerability recorded for aspnetcore-runtime-9.0 →
FAQ
The vulnerabilities include local file tampering via link following (CVE-2026-45491) and denial of service due to uncontrolled resource consumption (CVE-2026-45591).
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Failure to address these vulnerabilities can lead to unauthorized access, data corruption, and application downtime, severely impacting user trust and operational efficiency.
Yes, the local file tampering vulnerability could potentially lead to data loss or corruption if exploited by an attacker.
Detailed information can be found on the CVE pages for CVE-2026-45491 and CVE-2026-45591, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-9.0.
