Red Hat Security AdvisoryRHSA-2026:9205
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-04-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images dotnet9.0-9.0.116-1.hum1@src
Fixes 8 records
Priority HIGH 79
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.67162 · Published 2025-10-14 · Partial fix · 2.3.6, 8.0.21 +5 CWE-444
Priority MEDIUM 43
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02142 · Published 2026-04-14 · Fixed in 10.0.6, 8.0.26 +7 CWE-20
Priority MEDIUM 43
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01895 · Published 2026-04-14 · Fixed in 10.0.6, 8.0.26 +5 CWE-121
Priority MEDIUM 43
Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02279 · Published 2026-04-14 · Fixed in 10.0.6, 8.0.26 +3 CWE-138
Priority MEDIUM 42
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01753 · Published 2026-04-14 · Fixed in 10.0.6, 8.0.26 +4 CWE-400
Priority LOW 39
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01266 · Published 2025-05-13 · Partial fix · 8.0.16, 9.0.5 +12 CWE-73
Priority LOW 35
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00622 · Published 2025-10-14 · Partial fix · 8.0.21, 9.0.10 +6 CWE-59
Priority LOW 27
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00736 · Published 2025-10-14 · Partial fix · 8.0.21, 9.0.10 +7 CWE-326
THREATIST.IORead the docs