RHSA-2026:27171
Vulnerability from csaf_redhat - Published: 2026-06-19 02:03 - Updated: 2026-07-26 17:02Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
dotnet9.0:
* aspnetcore-runtime-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* aspnetcore-runtime-dbg-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* aspnetcore-targeting-pack-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* dotnet-apphost-pack-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* dotnet-hostfxr-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* dotnet-runtime-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* dotnet-runtime-dbg-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* dotnet-sdk-9.0-9.0.118-1.hum1 (aarch64, x86_64)
* dotnet-sdk-9.0-source-built-artifacts-9.0.118-1.hum1 (aarch64, x86_64)
* dotnet-sdk-aot-9.0-9.0.118-1.hum1 (aarch64, x86_64)
* dotnet-sdk-dbg-9.0-9.0.118-1.hum1 (aarch64, x86_64)
* dotnet-targeting-pack-9.0-9.0.17-1.hum1 (aarch64, x86_64)
* dotnet-templates-9.0-9.0.118-1.hum1 (aarch64, x86_64)
* netstandard-targeting-pack-2.1-9.0.118-1.hum1 (aarch64, x86_64)
* dotnet9.0-9.0.118-1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service (DoS) condition. The lack of limits or throttling mechanisms enables an attacker to disrupt the availability of the affected system.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service (DoS) condition, making the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service (DoS). An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash. This can disrupt the availability of services running on the .NET framework.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files.
7.0 (High)
Affected products
Fixed
3 products
Threats
Impact
Moderate
A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service (DoS), making the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system.
8.2 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system.
7.8 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service (DoS), making the affected system unresponsive or unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of malicious code on the system where the application is running.
7.8 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Framework. This vulnerability, caused by improper control of code generation, allows an unauthorized attacker to inject malicious code. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected system.
7.8 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in .NET Core. This vulnerability, known as type confusion, allows an unauthorized remote attacker to cause a denial of service (DoS) over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
References
82 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ndotnet9.0:\n * aspnetcore-runtime-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * aspnetcore-runtime-dbg-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * aspnetcore-targeting-pack-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * dotnet-apphost-pack-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * dotnet-hostfxr-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * dotnet-runtime-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * dotnet-runtime-dbg-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-9.0-9.0.118-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-9.0-source-built-artifacts-9.0.118-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-aot-9.0-9.0.118-1.hum1 (aarch64, x86_64)\n * dotnet-sdk-dbg-9.0-9.0.118-1.hum1 (aarch64, x86_64)\n * dotnet-targeting-pack-9.0-9.0.17-1.hum1 (aarch64, x86_64)\n * dotnet-templates-9.0-9.0.118-1.hum1 (aarch64, x86_64)\n * netstandard-targeting-pack-2.1-9.0.118-1.hum1 (aarch64, x86_64)\n * dotnet9.0-9.0.118-1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:27171",
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45736",
"url": "https://access.redhat.com/security/cve/CVE-2026-45736"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50646",
"url": "https://access.redhat.com/security/cve/CVE-2026-50646"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50527",
"url": "https://access.redhat.com/security/cve/CVE-2026-50527"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50526",
"url": "https://access.redhat.com/security/cve/CVE-2026-50526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50649",
"url": "https://access.redhat.com/security/cve/CVE-2026-50649"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50524",
"url": "https://access.redhat.com/security/cve/CVE-2026-50524"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50648",
"url": "https://access.redhat.com/security/cve/CVE-2026-50648"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50525",
"url": "https://access.redhat.com/security/cve/CVE-2026-50525"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50528",
"url": "https://access.redhat.com/security/cve/CVE-2026-50528"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50650",
"url": "https://access.redhat.com/security/cve/CVE-2026-50650"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47302",
"url": "https://access.redhat.com/security/cve/CVE-2026-47302"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57108",
"url": "https://access.redhat.com/security/cve/CVE-2026-57108"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50651",
"url": "https://access.redhat.com/security/cve/CVE-2026-50651"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27171.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-07-26T17:02:21+00:00",
"generator": {
"date": "2026-07-26T17:02:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:27171",
"initial_release_date": "2026-06-19T02:03:31+00:00",
"revision_history": [
{
"date": "2026-06-19T02:03:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-25T05:39:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-26T17:02:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "dotnet9-0-main@aarch64",
"product": {
"name": "dotnet9-0-main@aarch64",
"product_id": "dotnet9-0-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aspnetcore-runtime-9.0@9.0.17-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "dotnet9-0-main@x86_64",
"product": {
"name": "dotnet9-0-main@x86_64",
"product_id": "dotnet9-0-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aspnetcore-runtime-9.0@9.0.17-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "dotnet9-0-main@src",
"product": {
"name": "dotnet9-0-main@src",
"product_id": "dotnet9-0-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dotnet9.0@9.0.118-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "dotnet9-0-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:dotnet9-0-main@aarch64"
},
"product_reference": "dotnet9-0-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dotnet9-0-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:dotnet9-0-main@src"
},
"product_reference": "dotnet9-0-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dotnet9-0-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:dotnet9-0-main@x86_64"
},
"product_reference": "dotnet9-0-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-45736",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-05-15T16:00:55.786944+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477914"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in the `ws` WebSocket library for Node.js could lead to sensitive information disclosure. The flaw occurs when a `TypedArray` is specifically provided as the `reason` argument to the `websocket.close()` function, potentially exposing uninitialized memory. Red Hat products utilizing this library may be affected if their implementations allow for such a crafted `close()` call.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45736"
},
{
"category": "external",
"summary": "RHBZ#2477914",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477914"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45736",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45736"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45736"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086",
"url": "https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"
},
{
"category": "external",
"summary": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx",
"url": "https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx"
}
],
"release_date": "2026-05-15T14:53:57.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`"
},
{
"cve": "CVE-2026-47302",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-14T19:05:21.556064+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500515"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service (DoS) condition. The lack of limits or throttling mechanisms enables an attacker to disrupt the availability of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47302"
},
{
"category": "external",
"summary": "RHBZ#2500515",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500515"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47302"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47302",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47302"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302"
}
],
"release_date": "2026-07-14T18:45:32.796000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-50524",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-07-14T20:05:17.686937+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500593"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service (DoS) condition, making the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Denial of Service via improper input validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50524"
},
{
"category": "external",
"summary": "RHBZ#2500593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500593"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50524"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50524",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50524"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524"
}
],
"release_date": "2026-07-14T19:29:53.872000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Denial of Service via improper input validation"
},
{
"cve": "CVE-2026-50525",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-14T20:04:03.113976+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500580"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service (DoS). An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash. This can disrupt the availability of services running on the .NET framework.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Denial of Service due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50525"
},
{
"category": "external",
"summary": "RHBZ#2500580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500580"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50525"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50525",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50525"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525"
}
],
"release_date": "2026-07-14T19:29:54.357000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET: Denial of Service due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-50526",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-07-14T20:02:30.433807+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Local tampering via improper link resolution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50526"
},
{
"category": "external",
"summary": "RHBZ#2500565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50526"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526"
}
],
"release_date": "2026-07-14T19:29:54.992000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dotnet: .NET: Local tampering via improper link resolution"
},
{
"cve": "CVE-2026-50527",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-07-14T20:04:09.962274+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500581"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service (DoS), making the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Denial of Service via network-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50527"
},
{
"category": "external",
"summary": "RHBZ#2500581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50527"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50527",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50527"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527"
}
],
"release_date": "2026-07-14T19:29:55.564000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Denial of Service via network-based buffer overflow"
},
{
"cve": "CVE-2026-50528",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-07-14T20:02:07.038095+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500562"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Security feature bypass due to incorrect authorization",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50528"
},
{
"category": "external",
"summary": "RHBZ#2500562",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500562"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50528"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50528",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50528"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528"
}
],
"release_date": "2026-07-14T19:29:56.224000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET: Security feature bypass due to incorrect authorization"
},
{
"cve": "CVE-2026-50646",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-14T20:03:48.442720+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500577"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50646"
},
{
"category": "external",
"summary": "RHBZ#2500577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500577"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50646"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646"
}
],
"release_date": "2026-07-14T19:29:56.821000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure"
},
{
"cve": "CVE-2026-50648",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-14T20:04:45.063188+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500587"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service (DoS), making the affected system unresponsive or unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50648"
},
{
"category": "external",
"summary": "RHBZ#2500587",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500587"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50648"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648"
}
],
"release_date": "2026-07-14T19:29:57.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-50649",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-07-14T20:02:12.073604+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500563"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of malicious code on the system where the application is running.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET: Local code execution via deserialization of untrusted data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50649"
},
{
"category": "external",
"summary": "RHBZ#2500563",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500563"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50649",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50649"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50649",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50649"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649"
}
],
"release_date": "2026-07-14T19:29:57.970000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET: Local code execution via deserialization of untrusted data"
},
{
"cve": "CVE-2026-50650",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-07-14T20:01:20.750427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500556"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Framework. This vulnerability, caused by improper control of code generation, allows an unauthorized attacker to inject malicious code. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Framework: Privilege escalation via code injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50650"
},
{
"category": "external",
"summary": "RHBZ#2500556",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500556"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50650",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50650"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50650",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50650"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650"
}
],
"release_date": "2026-07-14T19:29:58.620000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Framework: Privilege escalation via code injection"
},
{
"cve": "CVE-2026-50651",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-10T20:34:51.149000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499217"
}
],
"notes": [
{
"category": "description",
"text": ".NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50651"
},
{
"category": "external",
"summary": "RHBZ#2499217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50651"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50651",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50651"
}
],
"release_date": "2026-07-14T21:37:42.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM"
},
{
"cve": "CVE-2026-57108",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-07-14T18:02:49.265651+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500109"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in .NET Core. This vulnerability, known as type confusion, allows an unauthorized remote attacker to cause a denial of service (DoS) over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dotnet: .NET Core: Denial of Service via type confusion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57108"
},
{
"category": "external",
"summary": "RHBZ#2500109",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500109"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57108"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57108",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57108"
},
{
"category": "external",
"summary": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108"
}
],
"release_date": "2026-07-14T17:09:39.087000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-19T02:03:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:27171"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:dotnet9-0-main@aarch64",
"Red Hat Hardened Images:dotnet9-0-main@src",
"Red Hat Hardened Images:dotnet9-0-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dotnet: .NET Core: Denial of Service via type confusion"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…