RHSA-2026:26638
Vulnerability from csaf_redhat - Published: 2026-06-17 15:25 - Updated: 2026-07-27 03:08Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
dotnet10.0:
* aspnetcore-runtime-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* aspnetcore-runtime-dbg-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* aspnetcore-targeting-pack-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* dotnet-apphost-pack-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* dotnet-host-10.0.9-1.hum1 (aarch64, x86_64)
* dotnet-hostfxr-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* dotnet-runtime-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* dotnet-runtime-dbg-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* dotnet-sdk-10.0-10.0.109-1.hum1 (aarch64, x86_64)
* dotnet-sdk-10.0-source-built-artifacts-10.0.109-1.hum1 (aarch64, x86_64)
* dotnet-sdk-aot-10.0-10.0.109-1.hum1 (aarch64, x86_64)
* dotnet-sdk-dbg-10.0-10.0.109-1.hum1 (aarch64, x86_64)
* dotnet-targeting-pack-10.0-10.0.9-1.hum1 (aarch64, x86_64)
* dotnet-templates-10.0-10.0.109-1.hum1 (aarch64, x86_64)
* dotnet10.0-10.0.109-1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory() method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issue to create or overwrite files in locations accessible to the extracting process, potentially leading to unauthorized file modification.
6.2 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:dotnet10-0-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:dotnet10-0-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:dotnet10-0-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in ASP.NET Core SignalR and Blazor Server. A remote attacker could send a specially crafted MessagePack payload containing deeply nested arrays that trigger excessive recursion and cause a stack overflow. This issue may result in application termination and a denial of service condition
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:dotnet10-0-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:dotnet10-0-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:dotnet10-0-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in ASP.NET Core. An authorized attacker can exploit an incorrect implementation of the authentication algorithm over a network. This vulnerability allows the attacker to elevate their privileges, potentially gaining unauthorized access to sensitive resources or performing actions beyond their intended permissions.
8.8 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service (DoS) condition. The lack of limits or throttling mechanisms enables an attacker to disrupt the availability of the affected system.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system.
8.8 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service (DoS) condition, making the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service (DoS). An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash. This can disrupt the availability of services running on the .NET framework.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files.
7.0 (High)
Affected products
Fixed
3 products
Threats
Impact
Moderate
A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service (DoS), making the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system.
8.2 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service (DoS), making the affected system unresponsive or unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity.
6.5 (Medium)
Affected products
Fixed
3 products
Threats
Impact
Moderate
A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service (DoS) by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Core. This vulnerability, known as type confusion, allows an unauthorized remote attacker to cause a denial of service (DoS) over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
References
100 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ndotnet10.0:\n * aspnetcore-runtime-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * aspnetcore-runtime-dbg-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * aspnetcore-targeting-pack-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * dotnet-apphost-pack-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * dotnet-host-10.0.9-1.hum1 (aarch64, x86_64)\n * dotnet-hostfxr-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * dotnet-runtime-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * dotnet-runtime-dbg-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-10.0-10.0.109-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-10.0-source-built-artifacts-10.0.109-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-aot-10.0-10.0.109-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-dbg-10.0-10.0.109-1.hum1 (aarch64, x86_64)\n * dotnet-targeting-pack-10.0-10.0.9-1.hum1 (aarch64, x86_64)\n * dotnet-templates-10.0-10.0.109-1.hum1 (aarch64, x86_64)\n * dotnet10.0-10.0.109-1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:26638",
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45591",
"url": "https://access.redhat.com/security/cve/CVE-2026-45591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45491",
"url": "https://access.redhat.com/security/cve/CVE-2026-45491"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45736",
"url": "https://access.redhat.com/security/cve/CVE-2026-45736"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50527",
"url": "https://access.redhat.com/security/cve/CVE-2026-50527"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50526",
"url": "https://access.redhat.com/security/cve/CVE-2026-50526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50524",
"url": "https://access.redhat.com/security/cve/CVE-2026-50524"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50648",
"url": "https://access.redhat.com/security/cve/CVE-2026-50648"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50525",
"url": "https://access.redhat.com/security/cve/CVE-2026-50525"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50528",
"url": "https://access.redhat.com/security/cve/CVE-2026-50528"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47302",
"url": "https://access.redhat.com/security/cve/CVE-2026-47302"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57108",
"url": "https://access.redhat.com/security/cve/CVE-2026-57108"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50651",
"url": "https://access.redhat.com/security/cve/CVE-2026-50651"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56170",
"url": "https://access.redhat.com/security/cve/CVE-2026-56170"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50659",
"url": "https://access.redhat.com/security/cve/CVE-2026-50659"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47303",
"url": "https://access.redhat.com/security/cve/CVE-2026-47303"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47300",
"url": "https://access.redhat.com/security/cve/CVE-2026-47300"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26638.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-07-27T03:08:14+00:00",
"generator": {
"date": "2026-07-27T03:08:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:26638",
"initial_release_date": "2026-06-17T15:25:52+00:00",
"revision_history": [
{
"date": "2026-06-17T15:25:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-25T05:39:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-27T03:08:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "dotnet10-0-main@aarch64",
"product": {
"name": "dotnet10-0-main@aarch64",
"product_id": "dotnet10-0-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aspnetcore-runtime-10.0@10.0.9-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "dotnet10-0-main@x86_64",
"product": {
"name": "dotnet10-0-main@x86_64",
"product_id": "dotnet10-0-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aspnetcore-runtime-10.0@10.0.9-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "dotnet10-0-main@src",
"product": {
"name": "dotnet10-0-main@src",
"product_id": "dotnet10-0-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dotnet10.0@10.0.109-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "dotnet10-0-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:dotnet10-0-main@aarch64"
},
"product_reference": "dotnet10-0-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dotnet10-0-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:dotnet10-0-main@src"
},
"product_reference": "dotnet10-0-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dotnet10-0-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:dotnet10-0-main@x86_64"
},
"product_reference": "dotnet10-0-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-45491",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-09T18:05:02.406017+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487164"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET\u0027s System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory() method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issue to create or overwrite files in locations accessible to the extracting process, potentially leading to unauthorized file modification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Local file tampering via link following vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects .NET\u0027s TAR archive extraction functionality. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.\n\nThe flaw occurs in System.Formats.Tar when processing TAR archives containing symbolic links. During extraction, the TarFile.ExtractToDirectory() method may incorrectly follow symlink paths and write files outside the intended extraction directory.\n\nSuccessful exploitation requires a vulnerable application to process a specially crafted TAR archive. An attacker could use this behavior to create or overwrite files in locations accessible to the extracting process, potentially affecting system or application integrity.\n\nThe vulnerability is a symlink path traversal issue that results in unauthorized file modification outside the designated extraction directory. The primary security impact is integrity compromise through arbitrary file writes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45491"
},
{
"category": "external",
"summary": "RHBZ#2487164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45491"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45491",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45491"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491"
}
],
"release_date": "2026-06-09T17:04:44.457000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dotnet: .NET: Local file tampering via link following vulnerability"
},
{
"cve": "CVE-2026-45591",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-09T18:07:51.180043+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ASP.NET Core SignalR and Blazor Server. A remote attacker could send a specially crafted MessagePack payload containing deeply nested arrays that trigger excessive recursion and cause a stack overflow. This issue may result in application termination and a denial of service condition",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects the MessagePack hub protocol implementation used by ASP.NET Core SignalR and Blazor Server. Red Hat Product Security has assessed this issue as an Important severity vulnerability.\n\nThe flaw occurs when processing deeply nested MessagePack arrays supplied by a remote attacker. Insufficient validation of message nesting depth may cause excessive recursion and trigger a stack overflow condition during message processing.\n\nSuccessful exploitation could allow an unauthenticated remote attacker to cause the affected application or service to terminate unexpectedly, resulting in a denial of service condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45591"
},
{
"category": "external",
"summary": "RHBZ#2487224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45591"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591"
}
],
"release_date": "2026-06-09T17:05:29.575000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption"
},
{
"cve": "CVE-2026-45736",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-05-15T16:00:55.786944+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477914"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in the `ws` WebSocket library for Node.js could lead to sensitive information disclosure. The flaw occurs when a `TypedArray` is specifically provided as the `reason` argument to the `websocket.close()` function, potentially exposing uninitialized memory. Red Hat products utilizing this library may be affected if their implementations allow for such a crafted `close()` call.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45736"
},
{
"category": "external",
"summary": "RHBZ#2477914",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477914"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45736",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45736"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086",
"url": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx",
"url": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx"
}
],
"release_date": "2026-05-15T14:53:57.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`"
},
{
"cve": "CVE-2026-47300",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-07-14T19:01:28.027271+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500492"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ASP.NET Core. An authorized attacker can exploit an incorrect implementation of the authentication algorithm over a network. This vulnerability allows the attacker to elevate their privileges, potentially gaining unauthorized access to sensitive resources or performing actions beyond their intended permissions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47300"
},
{
"category": "external",
"summary": "RHBZ#2500492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500492"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47300"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47300",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47300"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300"
}
],
"release_date": "2026-07-14T18:20:12.225000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm"
},
{
"cve": "CVE-2026-47302",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-14T19:05:21.556064+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500515"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service (DoS) condition. The lack of limits or throttling mechanisms enables an attacker to disrupt the availability of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47302"
},
{
"category": "external",
"summary": "RHBZ#2500515",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500515"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47302"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47302",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47302"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302"
}
],
"release_date": "2026-07-14T18:45:32.796000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-47303",
"cwe": {
"id": "CWE-472",
"name": "External Control of Assumed-Immutable Web Parameter"
},
"discovery_date": "2026-07-14T19:03:32.877670+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500502"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47303"
},
{
"category": "external",
"summary": "RHBZ#2500502",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500502"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47303"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47303",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47303"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303"
}
],
"release_date": "2026-07-14T18:45:33.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass"
},
{
"cve": "CVE-2026-50524",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-07-14T20:05:17.686937+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500593"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service (DoS) condition, making the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Denial of Service via improper input validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50524"
},
{
"category": "external",
"summary": "RHBZ#2500593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500593"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50524"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50524",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50524"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524"
}
],
"release_date": "2026-07-14T19:29:53.872000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Denial of Service via improper input validation"
},
{
"cve": "CVE-2026-50525",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-14T20:04:03.113976+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500580"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service (DoS). An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash. This can disrupt the availability of services running on the .NET framework.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Denial of Service due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50525"
},
{
"category": "external",
"summary": "RHBZ#2500580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500580"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50525"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50525",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50525"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525"
}
],
"release_date": "2026-07-14T19:29:54.357000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET: Denial of Service due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-50526",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-07-14T20:02:30.433807+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Local tampering via improper link resolution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50526"
},
{
"category": "external",
"summary": "RHBZ#2500565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50526"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526"
}
],
"release_date": "2026-07-14T19:29:54.992000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dotnet: .NET: Local tampering via improper link resolution"
},
{
"cve": "CVE-2026-50527",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-07-14T20:04:09.962274+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500581"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service (DoS), making the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Denial of Service via network-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50527"
},
{
"category": "external",
"summary": "RHBZ#2500581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50527"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50527",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50527"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527"
}
],
"release_date": "2026-07-14T19:29:55.564000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Denial of Service via network-based buffer overflow"
},
{
"cve": "CVE-2026-50528",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-07-14T20:02:07.038095+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500562"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Security feature bypass due to incorrect authorization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50528"
},
{
"category": "external",
"summary": "RHBZ#2500562",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500562"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50528"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50528",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50528"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528"
}
],
"release_date": "2026-07-14T19:29:56.224000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET: Security feature bypass due to incorrect authorization"
},
{
"cve": "CVE-2026-50648",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-14T20:04:45.063188+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500587"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service (DoS), making the affected system unresponsive or unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50648"
},
{
"category": "external",
"summary": "RHBZ#2500587",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500587"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50648"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648"
}
],
"release_date": "2026-07-14T19:29:57.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-50651",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-10T20:34:51.149000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499217"
}
],
"notes": [
{
"category": "description",
"text": ".NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50651"
},
{
"category": "external",
"summary": "RHBZ#2499217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50651"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50651",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50651"
}
],
"release_date": "2026-07-14T21:37:42.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM"
},
{
"cve": "CVE-2026-50659",
"cwe": {
"id": "CWE-838",
"name": "Inappropriate Encoding for Output Context"
},
"discovery_date": "2026-07-14T20:04:53.048725+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500589"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": ".NET: .NET: Network Spoofing Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50659"
},
{
"category": "external",
"summary": "RHBZ#2500589",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500589"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50659",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50659"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50659",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50659"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659"
}
],
"release_date": "2026-07-14T19:40:15.949000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": ".NET: .NET: Network Spoofing Vulnerability"
},
{
"cve": "CVE-2026-56170",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-14T18:06:54.194809+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500189"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service (DoS) by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56170"
},
{
"category": "external",
"summary": "RHBZ#2500189",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500189"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56170",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56170"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56170",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56170"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170"
}
],
"release_date": "2026-07-14T17:05:13.486000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation"
},
{
"cve": "CVE-2026-57108",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-07-14T18:02:49.265651+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500109"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Core. This vulnerability, known as type confusion, allows an unauthorized remote attacker to cause a denial of service (DoS) over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Core: Denial of Service via type confusion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57108"
},
{
"category": "external",
"summary": "RHBZ#2500109",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500109"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57108"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57108",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57108"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108"
}
],
"release_date": "2026-07-14T17:09:39.087000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T15:25:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26638"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet10-0-main@aarch64",
"Red Hat Hardened Images:dotnet10-0-main@src",
"Red Hat Hardened Images:dotnet10-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Core: Denial of Service via type confusion"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…