Back to Security Advisories

.NET 10.0 Security Update — AlmaLinux 8 (ALSA-2026:41900)

This is a security release for AlmaLinux 8. The fix ships in the current release line (referenced builds: 10.0.110, 10.0.10, 10.0). Update the product on every affected server to the patched release — there is no workaround, and unpatched servers remain exposed until updated.

High 7.5 CVSS
AlmaLinux 8

Affected Versions

10.0

Fix Commands

EL8+ (AlmaLinux/CloudLinux/Rocky)

sudo dnf update

What this means under a SharedLicense license

.net 10.0 on AlmaLinux 8 is the exposure surface; the advisory's own severity data tops out at CVSS 7.5 (CWE-770).

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es)…

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.  

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.  

Security Fix(es):  

  * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)
  * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)
  * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)
  * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)
  * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)
  * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)
  * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)
  * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)
  * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)
  * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)
  * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)
  * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)
  * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)
  * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)
  * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)
  * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)
  * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 (JIRA:AlmaLinux-192459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Frequently Asked Questions

What does ALSA-2026:41900 fix?
17 CVEs in .net 10.0, including the listed flaws (CVE-2026-50651, CVE-2026-57108).
Which release is covered?
AlmaLinux 8.
How do I apply it?
dnf update .net 10.0 — restart the service if it runs persistently.

References

Security Advisories

Related Advisories

Perl-CGI Security Update — AlmaLinux 8 (ALSA-2026:99849)

2026-11-12

.NET 8.0 Security Update — AlmaLinux 8 (ALSA-2026:99052)

2026-11-12

Grafana Security Update — AlmaLinux 8 (ALSA-2026:99030)

2026-11-12

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System