Most recent entries from all

ALSA-2026:25110 — Important: .NET 8.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-8.0, AlmaLinux:8: aspnetcore-runtime-dbg-8.0, AlmaLinux:8: aspnetcore-targeting-pack-8.0, AlmaLinux:8: dotnet-apphost-pack-8.0, AlmaLinux:8: dotnet-hostfxr-8.0, AlmaLinux:8: dotnet-runtime-8.0, AlmaLinux:8: dotnet-runtime-dbg-8.0, AlmaLinux:8: dotnet-sdk-8.0, AlmaLinux:8: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:8: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-08483

BIT-dotnet-2026-45591 — ASP.NET Core Denial of Service Vulnerability

Affected: Bitnami: dotnet

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

certfr-2026-avi-0728 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

certfr-2026-avi-0728

cnvd-2026-26513

EUVD-2026-374669

fkie_cve-2026-45591

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

GHSA-f8h2-vmm9-qhj6 — Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

Affected: NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64, NuGet: Microsoft.AspNetCore.App.Runtime.win-x64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-arm64, NuGet: Microsoft.AspNetCore.SignalR.Protocols.MessagePack

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core SignalR and Blazor Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in the MessagePack hub protocol used by SignalR and Blazor Server where an attacker can send deeply-nested MessagePack arrays to cause a stack overflow, resulting in a denial of service.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/405

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

### <a name=".NET 10"></a>.NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.8 | 10.0.9 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.8 | 10.0.9 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.8 | 10.0.9 [M…

msrc_CVE-2026-45591 — ASP.NET Core Denial of Service Vulnerability

msrc_CVE-2026-45591

NCSC-2026-0184 — Kwetsbaarheden verholpen in Microsoft Developer Tools

NCSC-2026-0184

RHSA-2026:17527 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

dotnet: .NET: infinite loop allows an attacker to cause a denial of service dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption

RHSA-2026:25110 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption

RLSA-2026:25110 — Important: .NET 8.0 security update

Affected: Rocky Linux:8: dotnet8.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-45591

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9, Ubuntu:26.04:LTS: dotnet10

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

WID-SEC-W-2026-1845 — Microsoft DeveloperTools: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, Microsoft ASP.NET, Microsoft .NET und Microsoft Visual Studio 2026 ausnutzen, um Administratorrechte zu erlangen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder die Authentifizierung zu umgehen.