Most recent entries from all

ALSA-2026:8468 — Important: .NET 8.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-8.0, AlmaLinux:8: aspnetcore-runtime-dbg-8.0, AlmaLinux:8: aspnetcore-targeting-pack-8.0, AlmaLinux:8: dotnet-apphost-pack-8.0, AlmaLinux:8: dotnet-hostfxr-8.0, AlmaLinux:8: dotnet-runtime-8.0, AlmaLinux:8: dotnet-runtime-dbg-8.0, AlmaLinux:8: dotnet-sdk-8.0, AlmaLinux:8: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:8: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK SDK_VERSION and .NET Runtime RUNTIME_VERSION.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-05457

BELL-CVE-2026-32178

Affected: Alpaquita:25: dotnet8-runtime, Alpaquita:stream: dotnet8-runtime

BIT-dotnet-2026-32178 — .NET Spoofing Vulnerability

Affected: Bitnami: dotnet

Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

certfr-2026-avi-0443 — De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Elles permettent à un attaquant de provoquer un dé…

certfr-2026-avi-0443

EUVD-2026-376293

fkie_cve-2026-32178

Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

GHSA-vmwf-m9c5-3jvc — Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability

Affected: NuGet: Microsoft.NetCore.App.Runtime.linux-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-x64, NuGet: Microsoft.NetCore.App.Runtime.osx-arm64, NuGet: Microsoft.NetCore.App.Runtime.osx-x64, NuGet: Microsoft.NetCore.App.Runtime.win-arm, NuGet: Microsoft.NetCore.App.Runtime.win-arm64 and 2 more

## Executive Summary:

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in System.Net.Mail where specially crafted data allows an unauthorized attacker to perform a spoofing attack over the network.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/12345

## CVSS Details

- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - **Weakness:** CWE-138: Improper Neutralization of Special Elements

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

### <a name=".NET 8"></a>.NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.25 | 8.0.26 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.25 | 8.0.26 [Microsoft.NetCore.App.Runtime.linux-musl-arm](ht…

msrc_CVE-2026-32178 — .NET Spoofing Vulnerability

msrc_CVE-2026-32178

NCSC-2026-0114 — Kwetsbaarheden verholpen in Microsoft Developer tools

NCSC-2026-0114

RHSA-2026:13280 — Red Hat Security Advisory: .NET 9.0 security update

dotnet: .NET: Security Bypass and Denial of Service Vulnerability dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw dotnet: .NET: Denial of Service via stack overflow dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform

RHSA-2026:13282 — Red Hat Security Advisory: .NET 9.0 security update

UBUNTU-CVE-2026-32178

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9, Ubuntu:26.04:LTS: dotnet10

Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

WID-SEC-W-2026-1100 — Microsoft DeveloperTools: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Microsoft .NET Framework, Microsoft .NET, Microsoft PowerShell und Microsoft Visual Studio Code ausnutzen, um vertrauliche Informationen offenzulegen, Spoofing-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen oder Sicherheitsmaßnahmen zu umgehen, was möglicherweise die Ausführung von beliebigem Code ermöglicht.