RHSA-2026:86169

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

MessagePack for C# is a MessagePack serializer for C#.

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.