Back to Security Advisories

.NET 11.0 Security Update — AlmaLinux 8 (ALSA-2026:92511)

ALSA-2026:92511 updates .NET 11.0 on AlmaLinux 8, fixing CVE-2026-62909 and CVE-2026-114148 (the latter re-delivering an incomplete earlier fix, CWE-252 unchecked-return class) at aggregate CVSS 7.8. Update the dotnet packages: dnf update dotnet* and restart .NET applications.

High 7.8 CVSS
AlmaLinux 8

Affected Versions

11.0

What this means under a SharedLicense license

Unchecked-return flaws in the runtime mean failures the application expects to handle pass through unhandled — in web workloads that class historically turns into remote code execution or authentication bypasses.

aarch64 dotnet-sdk-11.0-source-built-artifacts-11.0.100~rc.3.26522.148-0.12.el8_10.aarch64.rpm 165239b6ef0225049c5ec5cbfae56f912c54f1ace7a4230fd947feb77a23e23e aarch64 aspnetcore-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm 19a0fded1bf41c4f2016ff1f54ac02bfb9b82a07bba62b278cc917b055f35bee aarch64 aspnetcore-runtime-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm 21126931d5513804e76c8fd750ef3c9958b01750140c17028185c7f072b6bc64 aarch64 dotnet-host-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm 379e8a3c85284146ef3392778acf89ea14063114580a1ab02d8b6a7b4b9b9bd5 aarch64 dotnet-hostfxr-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm 42f24f725f62dcda3c20cb6ec834111c378195ee813a3a3d31e457f0ea701517 aarch64 dotnet-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm 912f71dce6379b9677bf828a969968e9d61aa331d11caa181150d51174ad4f6d aarch64 dotnet-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm 9d1f9c812920ac9f94eae1ee60ff93a776213d1ad62f4c767a4c9ca88ed7d5b0 aarch64 dotnet-sdk-aot-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.aarch64.rpm a4bfa08beb36f33d989e95ad0e8b15cca29fc0de0b52cff4b07412ffd07e8ba5 aarch64 dotnet-templates-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.aarch64.rpm ad739ddbef381b1710f8d55892f9809a1b4f53671e8a9e5e8558d95d44b26691 aarch64 dotnet-11.0.100~rc.3.26522.148-0.12.el8_10.aarch64.rpm b01c2356cb6ff1314534469fa49fea81bcadfc449e53ada1a7c819cb05ccd261 aarch64 dotnet-runtime-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm bec690f4ad946cfcba4b78910a6bbd025f476f746e81a12bbf8b2d2d00667de5 aarch64 dotnet-sdk-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.aarch64.rpm caea15b75ab0973c7f247c4611e8ef82d31a3b0a8d5f7cdb092bf3bb40546957 aarch64 aspnetcore-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm d939faa45d4278f017b23c42dcd78394c4bd5d0197267d7e18b34e111992943d aarch64 dotnet-sdk-dbg-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.aarch64.rpm dbf598e7f7913a7c780646ee2dca28f4b6693bea74a16df72ff2bdeebae59442 aarch64 dotnet-apphost-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.aarch64.rpm eebfdeb3241090f02ec2431a35e13465b5b5c99fda3111d4269e3c711a12be38 ppc64le aspnetcore-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 128c3d3b2f2a436b881225c327b709e9243b48922efbfa9e801471898dda72cb ppc64le dotnet-sdk-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 1599efef189f9a776ea5817454dfe50c0af1c7646ba7dd4d90261bd562a902f4 ppc64le dotnet-apphost-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 197a6952610f1cfc0cd9c46fc1d53522ff43d4e1d9f938e330ce4b72b2bbe258 ppc64le dotnet-templates-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 25138c845870eda50b12e600886411573d04ce998190c68903333a5de4e62179 ppc64le dotnet-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 325665b532d305ea533a3fe5b3aa1b248bd64c0fb4656706c2a36ae6e98e8790 ppc64le dotnet-hostfxr-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 36cdb043d70216bfdd1381c61fba3ce9a34e0caeb99cfdc7b2e50379f76b40ae ppc64le aspnetcore-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 62139fc39b6318a817c8bcfb25661f726d49e706c5cef918e0caee8979a44f97 ppc64le aspnetcore-runtime-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 734b231f0be25c0f1a9a686e83719fd7de63fe9acf676bab4a7f3eea10993ea3 ppc64le dotnet-sdk-dbg-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 75cf1e6128de9c6f0094372f4b5f0667b1d31a5d0a2febc39410521d9007a417 ppc64le dotnet-sdk-11.0-source-built-artifacts-11.0.100~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 7d041f363c3a43fb46449c815014d2c6c9972ed112074544487294e0e2befeb6 ppc64le dotnet-11.0.100~rc.3.26522.148-0.12.el8_10.ppc64le.rpm 9ed0b220c386ca26e4886be174540f0260e210863c49d3c3a7841e7f0710de37 ppc64le dotnet-runtime-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm c0f1c218c1c5792d17011cffba464768978ab4ef946314cd56a95295374d8393 ppc64le dotnet-host-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm cd0aafbb0aa4725cfe1c47440de970f8f0444f87d830b04862c58950ea4fc78e ppc64le dotnet-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.ppc64le.rpm da31950ea4c8f89fda011406e1b5d5e94b0ac5666bfedbbc56df666afea8fbf4 s390x dotnet-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm 2be300af7cc1f86ced32f7deb0298742878dbce222cdb4db4574c131ae749fa9 s390x aspnetcore-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm 3a35e410737d6a6f5a1f41e8fdce9ed17d1fc63425703ed778a1fdb4ed311ab2 s390x dotnet-hostfxr-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm 648193007fc837564aa00c557f102725a69377527e5fb5563725a300aa9b0c94 s390x dotnet-sdk-dbg-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.s390x.rpm 65c5ac55d060bbd9c33114adf1aa110111b61c9350b4b93655959e045c48a443 s390x dotnet-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm 7542cccd1d404747d49acd175bd8a18cb2646cefde14f2073942d2ac73a57a59 s390x aspnetcore-runtime-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm a3a48b0098ccb6f71c287fea36f48558848cec725a4fabf367417f473093d023 s390x dotnet-sdk-11.0-source-built-artifacts-11.0.100~rc.3.26522.148-0.12.el8_10.s390x.rpm a90ff1498abf93c45708aad4eaafdc6d9970292fb2f3657cd4e2542d6ea6d903 s390x dotnet-sdk-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.s390x.rpm c71aa87f31fec017af59891fe10027c8390464c6dee82dd2c01509d15fffb5e6 s390x dotnet-templates-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.s390x.rpm d3dab0230222d77ab09c40160c6afe7d7c43741349631e35d7cb93b8f4fd14e6 s390x dotnet-apphost-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm e9a0839fbd00674b1e7fab9c42b1a1366d4f9bed854859e727097b59775d4dfa s390x aspnetcore-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm e9dce50e98fdb3006c4e2744ec0f82a997b55b54ea722996113d3a32c0a484a5 s390x dotnet-runtime-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm ea96f328e3e403b8c884c773b9145b2053c7d59edf06a29017420bb944089a6e s390x dotnet-host-11.0.0~rc.3.26522.148-0.12.el8_10.s390x.rpm ee857378628fd0497ad22bdcd18cf213979ecb36bb859484417b60bcfb668bdc s390x dotnet-11.0.100~rc.3.26522.148-0.12.el8_10.s390x.rpm f1a081825fb0e60708d505397fa04bc0e9c2d6de1a55a2833c39b494ef0dfda0 x86_64 aspnetcore-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm 053b00476060ca2e932e676f95a61039eea7d4b9ab2e7ce26c8f87daad6851eb x86_64 aspnetcore-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm 1202c55fdc54f7448ac34d5efadf9c1cc4c2732b59e3de94737f977e11554d23 x86_64 dotnet-apphost-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm 37d192962b1b0444e7a58b60695abc3d40d10308e1207d439c3507034b5486c5 x86_64 aspnetcore-runtime-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm 491c4478baa58262bafd0bd3676e40c73aa233778aecfb18de3f6445afc4f7e3 x86_64 dotnet-sdk-aot-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.x86_64.rpm 5e6bd131a0adebe789b91b5b985a951ce019a0fd858d5193716c0a915560da34 x86_64 dotnet-runtime-dbg-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm 72dfc511ded5c1b59b100274315477c01ca275e9a4a13b1648eebfe82b07b2b6 x86_64 dotnet-host-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm 76c482be34c1a24a4e814b807b83402927965d7b489eb2ff864f5b2b1d3647be x86_64 dotnet-sdk-dbg-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.x86_64.rpm 7d62dd11627e4f553265f898a7bada458c4a7199cb660cd772465382a0722ba5 x86_64 dotnet-sdk-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.x86_64.rpm 81f455c064d05eec7017aaab795b357fbe9aa72f5d7980e34bcc12c19f19bc1c x86_64 dotnet-templates-11.0-11.0.100~rc.3.26522.148-0.12.el8_10.x86_64.rpm a3041b650ab12b0bab49dc7b12f4e83d67ff4193b1163c0696a407f943303949 x86_64 dotnet-hostfxr-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm b11019c01c946ff26f5f9bfb73b29d9b62a123d4c6fc532e854fe26f02fe3586 x86_64 dotnet-sdk-11.0-source-built-artifacts-11.0.100~rc.3.26522.148-0.12.el8_10.x86_64.rpm e264dddbeb1982c82c5fa44be172f9e721a7d0cfb39709b40463fe8d9ee10acf x86_64 dotnet-targeting-pack-11.0-11.0.0~rc.3.26522.148-0.12.el8_10.x86_64.rpm e2f9994d302a94afc8dc7516ec11cebbe177086f6dbd5141cf45c7234b6356fa x86_64 dotnet-11.0.100~rc.3.26522.148-0.12.el8_10.x86_64.rpm e99d22fdc0b866d207ba45f21d39e91630215c30a80c3cefed389250b7ec0a6f

Frequently Asked Questions

What is ALSA-2026:92511?
It is AlmaLinux's .NET 11.0 erratum for AlmaLinux 8, fixing CVE-2026-62909 and CVE-2026-114148 — the latter being the complete re-delivery of a fix originally released incomplete, classified CWE-252 (unchecked return value). Aggregate CVSS 7.8.
Who is affected?
AlmaLinux 8 servers with the .NET 11.0 packages installed — ASP.NET Core applications and .NET console services built against the 11.0 runtime.
How do I apply the fix?
Run dnf update dotnet* and restart your .NET applications so they run the patched runtime; verify the package versions match the erratum build.
Why was CVE-2026-114148 fixed twice?
The original advisory shipped an incomplete fix; this erratum re-delivers the complete correction. If you patched when the first notice shipped, apply this one too — the earlier fix did not fully close the flaw.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System