SB2026051502 - Fedora 42 update for dotnet8.0
Published: May 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Path traversal (CVE-ID: CVE-2026-32175)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in .NET Core. A remote user can send a specially crafted HTTP request and write arbitrary files on the system.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-32177)
The vulnerability allows a local attacker to escalate privileges on the target system.
The vulnerability exists due to a boundary error in .NET. A local attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and gain elevated privileges on the system.
3) Input validation error (CVE-ID: CVE-2026-35433)
The vulnerability allows a local attacker to escalate privileges on the target system.
The vulnerability exists due to insufficient validation of user-supplied input in .NET. A local attacker can gain elevated privileges on the system.
4) Infinite loop (CVE-ID: CVE-2026-42899)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in ASP.NET Core. A remote attacker can consume all available system resources and cause denial of service conditions.
Remediation
Install update from vendor's website.