Most recent entries from all

ALSA-2026:21286 — Important: .NET 8.0 security update

2026-10-02T16:07:21.081609+00:00

Affected: AlmaLinux:10: aspnetcore-runtime-8.0, AlmaLinux:10: aspnetcore-runtime-dbg-8.0, AlmaLinux:10: aspnetcore-targeting-pack-8.0, AlmaLinux:10: dotnet-apphost-pack-8.0, AlmaLinux:10: dotnet-hostfxr-8.0, AlmaLinux:10: dotnet-runtime-8.0, AlmaLinux:10: dotnet-runtime-dbg-8.0, AlmaLinux:10: dotnet-sdk-8.0, AlmaLinux:10: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:10: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-06767

2026-10-02T16:07:21.081696+00:00

bdu:2026-06767

BELL-CVE-2026-42899

2026-10-02T16:07:21.081714+00:00

Affected: Alpaquita:25: dotnet8-runtime, Alpaquita:stream: dotnet8-runtime

BIT-dotnet-2026-42899 — ASP.NET Core Denial of Service Vulnerability

2026-10-02T16:07:21.081736+00:00

Affected: Bitnami: dotnet

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

certfr-2026-avi-0585 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

2026-10-02T16:07:21.081757+00:00

certfr-2026-avi-0585

EUVD-2026-350479

2026-10-02T16:07:21.081772+00:00

EUVD-2026-350479

fkie_cve-2026-42899

2026-10-02T16:07:21.081782+00:00

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

GHSA-9v76-4qcc-frgh — Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

2026-10-02T16:07:21.081802+00:00

Affected: NuGet: Microsoft.AspNetCore.App.Runtime.win-arm, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.win-x64, NuGet: Microsoft.AspNetCore.App.Runtime.win-x86, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64 and 2 more

## Executive Summary:

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/397

## CVSS Details

- **Version:** 3.1 - **Severity:** - **Score:** 7.5 - **Vector:** AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

### .NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.7 | 10.0.8 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.7 | 10.0.8 [Microsoft.AspNetCore.App.Runtime.win-x64](https…

msrc_CVE-2026-42899 — ASP.NET Core Denial of Service Vulnerability

2026-10-02T16:07:21.081919+00:00

msrc_CVE-2026-42899

NCSC-2026-0143 — Kwetsbaarheden verholpen in Microsoft Developer Tools

2026-10-02T16:07:21.081937+00:00

NCSC-2026-0143

RHSA-2026:17464 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-02T16:07:21.081962+00:00

dotnet: .NET: infinite loop allows an attacker to cause a denial of service

RHSA-2026:21286 — Red Hat Security Advisory: .NET 8.0 security update

2026-10-02T16:07:21.081978+00:00

serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization dotnet: .NET: infinite loop allows an attacker to cause a denial of service

RLSA-2026:21286 — Important: .NET 8.0 security update

2026-10-02T16:07:21.081995+00:00

Affected: Rocky Linux:10: dotnet8.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)

* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-42899

2026-10-02T16:07:21.082019+00:00

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9, Ubuntu:26.04:LTS: dotnet10

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4

2026-10-02T16:07:21.082047+00:00

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

WID-SEC-W-2026-1488 — Microsoft Developer Tools: Mehrere Schwachstellen

2026-10-02T16:07:21.082084+00:00

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Microsoft Visual Studio Code, Microsoft .NET Framework und Microsoft .NET ausnutzen, um beliebigen Programmcode auszuführen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.