Most recent entries from all

ALSA-2026:4443 — Important: .NET 9.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-9.0, AlmaLinux:8: aspnetcore-runtime-dbg-9.0, AlmaLinux:8: aspnetcore-targeting-pack-9.0, AlmaLinux:8: dotnet-apphost-pack-9.0, AlmaLinux:8: dotnet-hostfxr-9.0, AlmaLinux:8: dotnet-runtime-9.0, AlmaLinux:8: dotnet-runtime-dbg-9.0, AlmaLinux:8: dotnet-sdk-9.0, AlmaLinux:8: dotnet-sdk-9.0-source-built-artifacts, AlmaLinux:8: dotnet-sdk-aot-9.0 and 4 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

* .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-03049

BELL-CVE-2026-26130

Affected: Alpaquita:25: dotnet8-runtime, Alpaquita:stream: dotnet8-runtime

certfr-2026-avi-0272 — De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Elles permettent à un attaquant de provoquer une é…

certfr-2026-avi-0272

EUVD-2026-337443

fkie_cve-2026-26130

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

GHSA-4vgm-c2wm-63mw — .NET Denial of Service Vulnerability

Affected: NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-x64, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2026-26130 – .NET Denial of Service Vulnerability

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/385

## CVSS Details

- **Version:** 3.1 - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Severity:** High - **Weakness:** CWE-770 (Uncontrolled Resource Consumption)

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## Affected Products

### <a name=".NET 8"></a>.NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, < =8.0.24 | 8.0.25 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, < =8.0.24 | 8.0.25 [Microsoft.AspNetCore.App.Runtime.linux-mus…

msrc_CVE-2026-26130 — ASP.NET Core Denial of Service Vulnerability

msrc_CVE-2026-26130

NCSC-2026-0085 — Kwetsbaarheden verholpen in Microsoft Developer tools

NCSC-2026-0085

RHSA-2026:10082 — Red Hat Security Advisory: .NET 8.0 security update

asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation

RHSA-2026:10084 — Red Hat Security Advisory: .NET 8.0 security update

asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation

UBUNTU-CVE-2026-26130

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9, Ubuntu:26.04:LTS: dotnet10

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

VDE-2026-064 — METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.

WID-SEC-W-2026-0657 — Microsoft ASP.NET und .NET: Mehrere Schwachstellen

Ein lokaler. oder ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft ASP.NET und Microsoft .NET ausnutzen, um Administratorrechte zu erlangen oder um einen Denial-of-Service-Zustand zu verursachen.