Most recent entries from all

ALSA-2026:4443 — Important: .NET 9.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-9.0, AlmaLinux:8: aspnetcore-runtime-dbg-9.0, AlmaLinux:8: aspnetcore-targeting-pack-9.0, AlmaLinux:8: dotnet-apphost-pack-9.0, AlmaLinux:8: dotnet-hostfxr-9.0, AlmaLinux:8: dotnet-runtime-9.0, AlmaLinux:8: dotnet-runtime-dbg-9.0, AlmaLinux:8: dotnet-sdk-9.0, AlmaLinux:8: dotnet-sdk-9.0-source-built-artifacts, AlmaLinux:8: dotnet-sdk-aot-9.0 and 4 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

* .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-02876

BIT-dotnet-2026-26127 — .NET Denial of Service Vulnerability

Affected: Bitnami: dotnet

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

certfr-2026-avi-0271 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

certfr-2026-avi-0271

EUVD-2026-328778

fkie_cve-2026-26127

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

GHSA-73j8-2gch-69rq — .NET Denial of Service Vulnerability

Affected: NuGet: Microsoft.Bcl.Memory, NuGet: Microsoft.NetCore.App.Runtime.linux-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NetCore.App.Runtime.linux-x64, NuGet: Microsoft.NetCore.App.Runtime.osx-arm64, NuGet: Microsoft.NetCore.App.Runtime.osx-x64, NuGet: Microsoft.NetCore.App.Runtime.win-arm and 3 more

# Microsoft Security Advisory CVE-2026-26127 – .NET Denial of Service Vulnerability

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/384

## CVSS Details

- **Version:** 3.1 - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Severity:** High - **Weakness:** CWE-129 (Improper Validation of Array Index); CWE-125 (Out-of-bounds Read)

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## Affected Products

### <a name=".NET 9"></a>.NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.…

msrc_CVE-2026-26127 — .NET Denial of Service Vulnerability

msrc_CVE-2026-26127

NCSC-2026-0085 — Kwetsbaarheden verholpen in Microsoft Developer tools

NCSC-2026-0085

RHSA-2026:10083 — Red Hat Security Advisory: .NET 9.0 security update

.net: .NET: Denial of Service via out-of-bounds read asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation

RHSA-2026:10085 — Red Hat Security Advisory: .NET 9.0 security update

.net: .NET: Denial of Service via out-of-bounds read asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation

UBUNTU-CVE-2026-26127

Affected: Ubuntu:22.04:LTS: dotnet7, Ubuntu:24.04:LTS: dotnet10, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet9

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

VDE-2026-064 — METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.

WID-SEC-W-2026-0657 — Microsoft ASP.NET und .NET: Mehrere Schwachstellen

Ein lokaler. oder ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft ASP.NET und Microsoft .NET ausnutzen, um Administratorrechte zu erlangen oder um einen Denial-of-Service-Zustand zu verursachen.