Moderate Vulnerability in .NET 8.0: Information Disclosure in aspnetcore-runtime-8.0
Summary
ALSA-2026:67524: Moderate: .NET 8.0 security, bug fix, and enhancement update. Affects aspnetcore-runtime-8.0 versions < 8.0.31-1.el9_8. Fixed in 8.0.31-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The .NET platform is a fast, lightweight, and modular framework designed for creating cross-platform applications that run on Linux, macOS, and Windows. It is particularly suited for developing console applications, web applications, and microservices. The platform includes a runtime that adheres to .NET Standards, a set of framework libraries, an SDK with compilers, and a 'dotnet' command-line application to manage development tasks. The recent vulnerability affects the aspnetcore-runtime-8.0 package, which is essential for running ASP.NET Core applications.
Vulnerability Detail
The vulnerability identified as CVE-2026-58649 is an Information Disclosure vulnerability within the .NET framework. This issue arises from improper handling of sensitive data, which could allow an attacker to access confidential information. The ramifications of this vulnerability could include unauthorized access to sensitive data, potentially leading to data breaches or exploitation of the affected applications. It is crucial for developers and system administrators to address this vulnerability promptly to mitigate risks.
How To Fix
Minimum fixed version
8.0.31-1.el9_8
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit access to the affected applications and monitor for any unusual activity until the updates can be applied. Implementing additional security measures, such as firewalls and intrusion detection systems, can also help mitigate the risk.
Conclusion
The .NET 8.0 vulnerability CVE-2026-58649 poses a moderate risk due to its potential for Information Disclosure. It is essential for users of the affected packages to apply the necessary updates promptly to safeguard their applications. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
CVE-2026-58649 is an Information Disclosure vulnerability in the .NET framework that could allow unauthorized access to sensitive data.
The affected packages include aspnetcore-runtime-8.0, dotnet-runtime-8.0, and several others within the .NET 8.0 ecosystem.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
If immediate updates are not possible, consider implementing security measures such as restricting access to the affected applications and monitoring for suspicious activity.
For more details, refer to the CVE page associated with CVE-2026-58649, which provides insights into the impact, CVSS score, and acknowledgments.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
