Red Hat Security AdvisoryRHSA-2025:18150
.NET 9.0 security update
Released 2025-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-9.0-9.0.10-1.el8_10, aspnetcore-runtime-dbg-9.0-9.0.10-1.el8_10, aspnetcore-targeting-pack-9.0-9.0.10-1.el8_10 +13
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el8_10
Fixes 3 records
Priority HIGH 79
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.67162 · Published 2025-10-14 · Partial fix · 2.3.6, 8.0.21 +5 CWE-444
Priority LOW 35
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00622 · Published 2025-10-14 · Partial fix · 8.0.21, 9.0.10 +6 CWE-59
Priority LOW 27
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00736 · Published 2025-10-14 · Partial fix · 8.0.21, 9.0.10 +7 CWE-326
