SB2026111343 - Ubuntu update for dotnet10, dotnet11, dotnet8
Published: November 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-105544)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges locally and gain the rights of the user running the affected application.
The vulnerability exists due to improper access control in .NET when an affected application is running. A local user can exploit a race condition, with user interaction, to gain the rights of the user running the affected application.
2) Stack-based buffer overflow (CVE-ID: CVE-2026-109475)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in .NET when processing network-supplied input. A remote attacker can send specially crafted input over a network to cause a denial of service.
3) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-109476)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, including cookie data and cached sessions.
The vulnerability exists due to improper encoding or escaping of output in ASP.NET Core when generating output. A remote attacker can exploit the improperly encoded or escaped output, with user interaction, to bypass protections against reading cookies and disclose sensitive session information.
4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-109478)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in ASP.NET Core when processing network requests. A remote attacker can send specially crafted requests that trigger excessive resource consumption to cause a denial of service.
5) Cross-site request forgery (CVE-ID: CVE-2026-109481)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to insufficient validation of request authenticity in ASP.NET Core when handling state-changing requests. A remote attacker can trick a victim into submitting a forged request in the context of their session to escalate privileges, potentially compromising data confidentiality, data integrity, and service availability.
6) Incorrect authorization (CVE-ID: CVE-2026-114146)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and perform actions with another user's application privileges.
The vulnerability exists due to incorrect authorization in ASP.NET Core when handling requests triggered by a specially crafted link. A remote user can convince a privileged user to follow such a link to an affected application to perform actions with that user's application privileges.
7) Memory leak (CVE-ID: CVE-2026-114147)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after its effective lifetime in ASP.NET Core when handling network requests. A remote attacker can send requests that trigger the memory leak to exhaust available memory and cause a denial of service.
8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-114149)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network requests. A remote attacker can send requests that trigger excessive resource consumption to cause a denial of service.
9) Use of uninitialized resource (CVE-ID: CVE-2026-114150)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of an uninitialized resource in ASP.NET Core when handling network requests. A remote attacker can trigger use of the uninitialized resource to disclose information that should not be accessible.
10) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-114155)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges and execute code with another user's permissions, gaining access to that user's data and resources.
The vulnerability exists due to a time-of-check time-of-use race condition in .NET when a resource changes between being checked and being used. A local user can win a race condition during an operation requiring user interaction to execute code with another user's permissions.
11) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-114156)
CWE-ID: CWE-41 - Improper Resolution of Path Equivalence
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security features and potentially access or modify protected information.
The vulnerability exists due to improper resolution of path equivalence in ASP.NET Core when handling network requests. A remote attacker can submit specially crafted requests using equivalent path representations to bypass security checks and potentially access or modify protected information.
12) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-118746)
CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication through impersonation and read or modify network communications.
The vulnerability exists due to failure to fail securely in the .NET authentication feature when handling network communications associated with a victim's request. A remote attacker can position themselves in the logical network path between the target and the resource requested by the victim to bypass authentication through impersonation and read or modify network communications.
13) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-118748)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network requests. A remote attacker can send requests that exhaust available resources to cause a denial of service.
14) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-118749)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in ASP.NET Core when processing network requests. A remote attacker can send specially crafted requests that trigger excessive computational resource consumption to cause a denial of service.
15) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-120796)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in .NET and System.Text.Json when processing network-supplied input. A remote attacker can submit specially crafted input that triggers excessive computational work to cause a denial of service.
Remediation
Install update from vendor's website.