Critical Security Update for .NET SDK 9.0: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:8472: Important: .NET 9.0 security update. Affects dotnet-sdk-9.0-source-built-artifacts versions < 9.0.116-1.el10_1. Fixed in 9.0.116-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The .NET SDK 9.0 is a managed-software framework that provides developers with tools and libraries to build applications across various platforms. It implements a subset of the .NET framework APIs and introduces several new APIs, along with a Common Language Runtime (CLR) implementation. This framework is widely used for developing web, mobile, and desktop applications. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built using this SDK.
Vulnerability Detail
The vulnerabilities in .NET SDK 9.0 include a security bypass and denial of service (DoS) vulnerabilities, which could allow attackers to exploit applications built on this framework. Specifically, CVE-2026-26171 allows for security bypass, while CVE-2026-32203 and CVE-2026-33116 can lead to denial of service through stack overflow and infinite recursion, respectively. Additionally, CVE-2026-32178 exposes applications to SMTP command injection and header injection due to flaws in MailAddress parsing. These vulnerabilities can lead to application crashes, unauthorized access, and potential data breaches.
How To Fix
Minimum fixed version
9.0.116-1.el10_1
This is the first release that contains the fix.
sudo dnf update dotnet-sdk-9.0-source-built-artifactsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing input validation and sanitization in your applications to mitigate the risk of injection attacks. Additionally, limit the use of features that are known to be vulnerable until the update is applied.
Conclusion
The recent vulnerabilities identified in .NET SDK 9.0 pose significant risks to applications built using this framework. It is crucial for developers to update to the latest patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for dotnet-sdk-9.0-source-built-artifacts →
FAQ
The vulnerabilities can lead to application crashes, unauthorized access, and potential data breaches, affecting the security and reliability of applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without requiring access to the code.
Implement input validation and sanitization in your applications as a temporary workaround to reduce the risk of exploitation.
Yes, you can run 'sudo dnf update dotnet-sdk-9.0-source-built-artifacts' to update to the patched version.
For detailed information, refer to the CVE pages associated with the vulnerabilities, such as CVE-2026-26171, CVE-2026-32178, CVE-2026-32203, and CVE-2026-33116.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
