Critical Security Update for .NET 9.0: Addressing Multiple Vulnerabilities
Summary
RLSA-2026:8472: Important: .NET 9.0 security update. Affects dotnet9.0 versions < 0:9.0.116-1.el10_1. Fixed in 0:9.0.116-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET framework is a managed-software platform that provides a comprehensive environment for building and running applications. It includes a subset of the .NET framework APIs along with several new APIs and a Common Language Runtime (CLR) implementation. The framework is widely used for developing web, mobile, and desktop applications. However, recent vulnerabilities have been identified in .NET 9.0, necessitating immediate attention to ensure the security and integrity of applications built on this platform.
Vulnerability Detail
The vulnerabilities in .NET 9.0 include a security bypass and denial of service (CVE-2026-26171), a denial of service via stack overflow (CVE-2026-32203), infinite recursion in XmlDecryptionTransform leading to denial of service (CVE-2026-33116), and SMTP command injection and header injection via MailAddress parsing flaw (CVE-2026-32178). These vulnerabilities could allow attackers to exploit the system, potentially leading to unauthorized access, application crashes, or data breaches.
How To Fix
Minimum fixed version
0:9.0.116-1.el10_1
This is the first release that contains the fix.
sudo dnf update dotnet9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their applications by implementing strict input validation and sanitization to mitigate the risk of command injection and denial of service attacks. Additionally, consider disabling any features that utilize the affected APIs until the update is applied.
Conclusion
The recent vulnerabilities identified in .NET 9.0 pose significant risks to applications built on this framework. It is crucial for developers and system administrators to promptly apply the necessary updates to mitigate these risks and ensure the security of their applications. Utilizing tools like Vulert can further enhance your ability to monitor and respond to vulnerabilities in real-time.
See every vulnerability recorded for dotnet9.0 →
FAQ
The CVSS score for these vulnerabilities is 7.5, indicating a high level of risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Failing to apply the update may leave your application vulnerable to exploitation, which could lead to unauthorized access, data breaches, or service disruptions.
Yes, you can set up a cron job or use configuration management tools like Ansible or Puppet to automate the update process for your .NET packages.
For detailed information about the vulnerabilities, refer to the CVE pages listed in the references section of the vulnerability report.
References
Related vulnerabilities
Recent vulnerabilities recorded for dotnet9.0.
