Back to Security Advisories

.NET 8.0 Security Update — AlmaLinux 8 (ALSA-2026:86594)

ALSA-2026:86594 is a large .NET 8.0 security update for AlmaLinux 8, fixing 21 CVEs (CVE-2026-58280, CVE-2026-66822, CVE-2026-69651 and the CVE-2026-701xx / CVE-2026-962xx series among others). Update the dotnet packages: dnf update dotnet* and restart .NET 8 applications so they run the patched runtime.

Critical 7.5 CVSS
AlmaLinux 8

Affected Versions

8.0

What this means under a SharedLicense license

.NET 8 powers production web APIs and services — a 21-CVE batch in the runtime itself touches the parsing, networking and crypto layers every application on the server relies on.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 8.0.132  
Runtime version: 8.0.32  

Security Fix(es):  

  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 (JIRA:AlmaLinux-277790)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Frequently Asked Questions

What is ALSA-2026:86594?
It is AlmaLinux's .NET 8.0 security erratum, fixing 21 CVEs across the .NET runtime and base libraries — including the CVE-2026-701xx, CVE-2026-962xx and CVE-2026-58280/66822/69651 series.
Who is affected?
AlmaLinux 8 servers with .NET 8.0 packages installed — ASP.NET Core applications, microservices and .NET console tooling.
How do I apply the fix?
Run dnf update dotnet* and restart your .NET 8 applications so they run the patched runtime; verify the package versions match the erratum.
Is this related to the earlier .NET Ubuntu notice?
They are separate vendor deliveries — Ubuntu shipped its .NET fixes in USN-8958-1, AlmaLinux in this erratum. Both close flaws in the same upstream .NET codebase; apply per platform installed.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System