SB2026101685 - Fedora 43 update for dotnet8.0
Published: October 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 40 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-96232)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose internal memory pointers.
The vulnerability exists due to an out-of-bounds read in .NET when handling network input. A remote attacker can exploit the out-of-bounds read over a network to disclose internal memory pointers.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-87697)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in .NET when processing an attacker-supplied file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.
3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-88092)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to tamper with server-side HTTP request handling.
The vulnerability exists due to inconsistent interpretation of HTTP requests in ASP.NET Core when processing HTTP/1.1 requests forwarded through a reverse proxy. A remote attacker can send specially crafted requests that desynchronize request handling between the proxy and the server and inject an unintended request to tamper with server-side HTTP request handling.
User interaction is not required.
4) Improperly Controlled Sequential Memory Allocation (CVE-ID: CVE-2026-92707)
CWE-ID: CWE-1325 - Improperly Controlled Sequential Memory Allocation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improperly controlled sequential memory allocation in MessagePack-CSharp when handling network input. A remote attacker can trigger sequential memory allocations over a network to cause a denial of service.
5) Improper Certificate Validation (CVE-ID: CVE-2026-96222)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform spoofing.
The vulnerability exists due to improper certificate validation in Active Directory Federation Services (AD FS) when validating certificates during network communications. A remote attacker can exploit the certificate validation flaw over a network to perform spoofing.
Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.
6) Out-of-bounds write (CVE-ID: CVE-2026-96224)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in .NET when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.
7) Link following (CVE-ID: CVE-2026-96225)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to root.
The vulnerability exists due to improper link resolution before file access in .NET when accessing files through links. A local user can exploit link-following behavior to escalate privileges to root.
8) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-96229)
CWE-ID: CWE-183 - Permissive List of Allowed Inputs
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to a permissive list of allowed inputs in .NET when processing inputs over a network. A remote attacker can exploit the permissive input allowlist to disclose NetNTLMv2 hashes.
User interaction is required for exploitation.
9) Cross-site scripting (CVE-ID: CVE-2026-96230)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute code in the developer's context.
The vulnerability exists due to improper neutralization of input during web page generation (cross-site scripting) in ASP.NET Core when generating web pages. A remote attacker can host a specially crafted web page and convince a developer to visit it, causing the page to send requests to a vulnerable development server running on the developer's system, to execute code in the developer's context.
10) Link following (CVE-ID: CVE-2026-96231)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to root.
The vulnerability exists due to improper link resolution before file access in .NET when accessing files. A local user can exploit link following during local file access to escalate privileges to root.
11) Use-after-free (CVE-ID: CVE-2026-85790)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose heap memory from a privileged process running on the server.
The vulnerability exists due to use-after-free in Microsoft QUIC when handling network communications. A remote attacker can exploit the flaw over a network to disclose heap memory from a privileged process running on the server.
Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.
12) Out-of-bounds write (CVE-ID: CVE-2026-96233)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in ASP.NET Core when handling network input. A remote attacker can interact with the affected component over a network to cause a denial of service.
13) Origin validation error (CVE-ID: CVE-2026-96234)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose credentials.
The vulnerability exists due to an origin validation error in .NET when validating origins during network interactions. A remote attacker can exploit this error over a network to disclose credentials.
Successful exploitation requires user interaction and additional actions to prepare the target environment.
14) Out-of-bounds write (CVE-ID: CVE-2026-96235)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in .NET when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.
15) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-96236)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network requests. A remote attacker can send requests over a network to cause a denial of service.
16) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-96237)
CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to inclusion of functionality from an untrusted control sphere in .NET when incorporating functionality from an untrusted source. A remote attacker can exploit this untrusted functionality over a network to execute arbitrary code.
Successful exploitation requires additional actions to prepare the target environment and user interaction.
17) Origin validation error (CVE-ID: CVE-2026-96238)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass NuGet Package Source Mapping.
The vulnerability exists due to an origin validation error in NuGet Package Source Mapping in .NET when selecting packages from package sources. A remote attacker can cause content from an unauthorized package source to be selected and installed to bypass restrictions limiting packages to approved sources.
User interaction is required.
18) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-96958)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in .NET when handling network input. A remote attacker can send input over a network to cause a denial of service.
19) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-96959)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in .NET when handling network requests. A remote attacker can trigger excessive resource allocation over the network to cause a denial of service.
20) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2026-96960)
CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to asymmetric resource consumption (amplification) in .NET when handling network input. A remote attacker can trigger amplified resource consumption over a network to cause a denial of service.
21) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-70179)
CWE-ID: CWE-290 - Authentication Bypass by Spoofing
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to authentication bypass by spoofing in ASP.NET Core when authenticating users over a network. A remote user can bypass authentication through spoofing to escalate privileges.
Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition.
22) Uncontrolled Recursion (CVE-ID: CVE-2026-58280)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in .NET when handling network interactions. A remote attacker can trigger uncontrolled recursion over the network to cause a denial of service.
23) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-66822)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, including credentials.
The vulnerability exists due to insertion of sensitive information into sent data in .NET when sending data over a network. A remote attacker can access exposed data to disclose sensitive information, including credentials.
Successful exploitation requires specific protocol settings or configurations to be in place.
24) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-69651)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in .NET when handling network input. A remote attacker can exploit the affected algorithm over a network to cause a denial of service.
25) Out-of-bounds write (CVE-ID: CVE-2026-70007)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in .NET Framework when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.
26) Deserialization of Untrusted Data (CVE-ID: CVE-2026-70035)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in .NET Framework when processing attacker-supplied files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.
27) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70159)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network requests. A remote attacker can trigger resource allocation over the network to cause a denial of service.
28) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2026-70162)
CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service against a .NET web application.
The vulnerability exists due to asymmetric resource consumption in Microsoft Common Object Runtime Library when handling web requests. A remote attacker can issue specially crafted requests to a .NET web application to cause a denial of service.
29) Improperly implemented security check for standard (CVE-ID: CVE-2026-70174)
CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an improperly implemented security check for a standard in .NET when handling a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.
30) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: CVE-2026-70175)
CWE-ID: CWE-640 - Weak password recovery mechanism
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges and take over a targeted account.
The vulnerability exists due to a weak password recovery mechanism in ASP.NET Core when processing password reset requests. A remote attacker can submit a password reset request using a specially crafted email address that is treated as equivalent to another account to escalate privileges and take over a targeted account.
No user interaction is required. Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition.
31) Heap-based buffer overflow (CVE-ID: CVE-2026-105016)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a heap-based buffer overflow in Microsoft QUIC when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code on the target system.
No user interaction is required.
32) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70181)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network traffic. A remote attacker can trigger unbounded resource allocation to cause a denial of service.
33) Race condition (CVE-ID: CVE-2026-70183)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper synchronization of a shared resource in ASP.NET Core when concurrently accessing the resource. A remote user can win a race condition to escalate privileges.
34) Deadlock (CVE-ID: CVE-2026-70186)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a deadlock in ASP.NET Core when accessed over a network. A remote attacker can trigger the deadlock to cause a denial of service.
35) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-70188)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication and access protected resources.
The vulnerability exists due to inconsistent interpretation of HTTP requests in ASP.NET Core when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP/2 requests to bypass authentication and access protected resources.
No user interaction is required.
36) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-70196)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in ASP.NET Core when handling network traffic. A remote attacker can trigger inefficient processing over a network to cause a denial of service.
37) Out-of-bounds write (CVE-ID: CVE-2026-70197)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in .NET when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.
No user interaction is required. Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition.
38) Deserialization of Untrusted Data (CVE-ID: CVE-2026-83520)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in .NET when processing data from a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.
39) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-84008)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in .NET when handling network input. A remote attacker can trigger the affected functionality over a network to cause a denial of service.
40) Integer overflow (CVE-ID: CVE-2026-85363)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain SYSTEM privileges.
The vulnerability exists due to integer overflow or wraparound in .NET Framework when the framework is accessed over a network. A remote attacker can exploit this weakness to gain SYSTEM privileges.
User interaction is required for successful exploitation.
Remediation
Install update from vendor's website.