Most recent entries from all

ALSA-2026:25110 — Important: .NET 8.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-8.0, AlmaLinux:8: aspnetcore-runtime-dbg-8.0, AlmaLinux:8: aspnetcore-targeting-pack-8.0, AlmaLinux:8: dotnet-apphost-pack-8.0, AlmaLinux:8: dotnet-hostfxr-8.0, AlmaLinux:8: dotnet-runtime-8.0, AlmaLinux:8: dotnet-runtime-dbg-8.0, AlmaLinux:8: dotnet-sdk-8.0, AlmaLinux:8: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:8: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-08675

BIT-dotnet-2026-45491 — .NET Tampering Vulnerability

Affected: Bitnami: dotnet

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

certfr-2026-avi-0728 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

certfr-2026-avi-0728

EUVD-2026-374595

fkie_cve-2026-45491

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

GHSA-7q4v-2mr6-5gpx — Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

Affected: NuGet: Microsoft.NETCore.App.Runtime.linux-x64, NuGet: Microsoft.NETCore.App.Runtime.win-x64, NuGet: Microsoft.NETCore.App.Runtime.osx-arm64

## Executive Summary

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Formats.Tar. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A tampering vulnerability exists in the `TarFile.ExtractToDirectory` method where a symlink path traversal enables an attacker to perform arbitrary file writes outside the intended extraction directory.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/404

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

### .NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NETCore.App.Runtime](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime) | >= 10.0.0, <= 10.0.8 | 10.0.9

### .NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NETCore.App.Runtime](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime) | >= 9.0.0, <= 9.0.16 | 9.0.17

### .NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NETCore.App.Runtime](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime) | >= 8.0.0…

msrc_CVE-2026-45491 — .NET Tampering Vulnerability

msrc_CVE-2026-45491

NCSC-2026-0184 — Kwetsbaarheden verholpen in Microsoft Developer Tools

NCSC-2026-0184

RHSA-2026:17527 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

dotnet: .NET: infinite loop allows an attacker to cause a denial of service dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption

RHSA-2026:25110 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption

RLSA-2026:25110 — Important: .NET 8.0 security update

Affected: Rocky Linux:8: dotnet8.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-45491

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9, Ubuntu:26.04:LTS: dotnet10

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

WID-SEC-W-2026-1845 — Microsoft DeveloperTools: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, Microsoft ASP.NET, Microsoft .NET und Microsoft Visual Studio 2026 ausnutzen, um Administratorrechte zu erlangen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder die Authentifizierung zu umgehen.