Most recent entries from all

ALSA-2026:41893 — Important: .NET 8.0 security, bug fix, and enhancement update

2026-10-02T12:51:43.730288+00:00

Affected: AlmaLinux:10: aspnetcore-runtime-8.0, AlmaLinux:10: aspnetcore-runtime-dbg-8.0, AlmaLinux:10: aspnetcore-targeting-pack-8.0, AlmaLinux:10: dotnet-apphost-pack-8.0, AlmaLinux:10: dotnet-hostfxr-8.0, AlmaLinux:10: dotnet-runtime-8.0, AlmaLinux:10: dotnet-runtime-dbg-8.0, AlmaLinux:10: dotnet-sdk-8.0, AlmaLinux:10: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:10: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled re…

bdu:2026-10972

2026-10-02T12:51:43.730400+00:00

bdu:2026-10972

BIT-dotnet-2026-47302 — .NET Denial of Service Vulnerability

2026-10-02T12:51:43.730420+00:00

Affected: Bitnami: dotnet

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

certfr-2026-avi-0869 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

2026-10-02T12:51:43.730442+00:00

certfr-2026-avi-0869

EUVD-2026-376473

2026-10-02T12:51:43.730458+00:00

EUVD-2026-376473

fkie_cve-2026-47302

2026-10-02T12:51:43.730470+00:00

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

GHSA-cvvh-rhrc-wg4q — Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

2026-10-02T12:51:43.730492+00:00

Affected: NuGet: System.Security.Cryptography.Xml, NuGet: Microsoft.NetCore.App.Runtime.linux-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NetCore.App.Runtime.linux-x64, NuGet: Microsoft.NetCore.App.Runtime.osx-arm64, NuGet: Microsoft.NetCore.App.Runtime.osx-x64, NuGet: Microsoft.NetCore.App.Runtime.win-arm and 3 more

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/410

## CVSS Details

- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-770 (Allocation of Resources Without Limits or Throttling)

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

### .NET 10.0 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 10.0.0, <= 10.0.9 | 10.0.10 [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-a…

jvndb-2026-032925

2026-10-02T12:51:43.730618+00:00

CVE-2026-33842 | Windows File Explorer Information Disclosure Vulnerability CVE-2026-34328 | Windows Audio Service Information Disclosure Vulnerability CVE-2026-34346 | Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability CVE-2026-34348 | Windows Event Logging Service Information Disclosure Vulnerability CVE-2026-34349 | Windows Media Information Disclosure Vulnerability CVE-2026-40378 | Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability CVE-2026-40400 | Windows PowerShell Remote Code Execution Vulnerability CVE-2026-40422 | Windows File Explorer Information Disclosure Vulnerability CVE-2026-41087 | Windows File Explorer Information Disclosure Vulnerability CVE-2026-42900 | Microsoft Windows App Store Elevation of Privilege Vulnerability CVE-2026-42975 | Windows Bluetooth Port Driver Remote Code Execution CVE-2026-42982 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability CVE-2026-42990 | SQL Server ODBC driver Elevation of Privilege Vulnerability CVE-2026-44806 | Windows Secure Channel Denial of Service Vulnerability CVE-2026-47302 | .NET Denial of Service Vulnerability CVE-2026-48564 | DHCP Server Service Remote Code Execution Vulnerability CVE-2026-49164 | Windows Active Directory Domain Services Remote Code Execution Vulnerability CVE-2026-49165 | Microsoft Windows App Store Information Disclosure Vulnerability CVE-2026-49167 | Windows Kernel Elevation of Privilege Vulner…

msrc_CVE-2026-47302 — .NET Denial of Service Vulnerability

2026-10-02T12:51:43.730732+00:00

msrc_CVE-2026-47302

NCSC-2026-0235 — Kwetsbaarheden verholpen in Microsoft Developer Tools

2026-10-02T12:51:43.730751+00:00

NCSC-2026-0235

RHSA-2026:26638 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-02T12:51:43.730791+00:00

dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass dotnet: .NET Framework: Denial of Service via improper input validation dotnet: .NET: Denial of Service due to uncontrolled resource allocation dotnet: .NET: Local tampering via improper link resolution dotnet: .NET Framework: Denial of Service via network-based buffer overflow dotnet: .NET: Security feature bypass due to incorrect authorization dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM .NET: .NET: Network Spoofing Vulnerability ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation dotnet: .NET Core: Denial of Service via type confusion

RHSA-2026:41893 — Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

2026-10-02T12:51:43.730833+00:00

ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass dotnet: .NET Security Feature Bypass Vulnerability dotnet: .NET Framework: Denial of Service via improper input validation dotnet: .NET: Denial of Service due to uncontrolled resource allocation dotnet: .NET: Local tampering via improper link resolution dotnet: .NET Framework: Denial of Service via network-based buffer overflow dotnet: .NET: Security feature bypass due to incorrect authorization dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation dotnet: .NET: Local code execution via deserialization of untrusted data dotnet: .NET Framework: Privilege escalation via code injection dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM .NET: .NET: Network Spoofing Vulnerability ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation dotnet: .NET Core: Denial of Service via type confusion

RLSA-2026:41893 — Important: .NET 8.0 security, bug fix, and enhancement update

2026-10-02T12:51:43.730876+00:00

Affected: Rocky Linux:10: dotnet8.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET: Denial of Service due to uncontrolled resource allocation (C…

UBUNTU-CVE-2026-47302

2026-10-02T12:51:43.730920+00:00

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:26.04:LTS: dotnet10

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

WID-SEC-W-2026-2324 — Microsoft DeveloperTools: Mehrere Schwachstellen

2026-10-02T12:51:43.730948+00:00

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, .NET Framework, Microsoft .NET, Visual Studio 2022 und Visual Studio 2026 ausnutzen, um erweiterte Berechtigungen, einschließlich Administratorrechte, zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen, einen Denial-of-Service-Zustand auszulösen oder Spoofing-Angriffe durchzuführen.