Back to Security Advisories

.NET Vulnerabilities — Ubuntu Security Update (USN-8958-1)

USN-8958-1 fixes three .NET vulnerabilities on Ubuntu (CVE-2026-102870, CVE-2026-111497 and CVE-2026-114148), including a Blazor WebAssembly debug-proxy code-execution flaw (CWE-94) — with the notable detail that the CVE-2026-111497 fix from USN-8942-1 was found incomplete and is re-delivered here. Aggregate CVSS 8.8. Update the dotnet/aspnetcore packages: sudo apt update && sudo apt upgrade.

Critical 8.8 CVSS Actively exploited
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

A re-incomplete fix means systems patched via the earlier USN remain exposed to the original code-execution flaw — .NET applications running the debug proxy or processing untrusted input need this second update applied.

Ubuntu Release Package Version
26.10

stonking

 aspnetcore-runtime-10.0 – 

10.0.14-0ubuntu1~26.10.1
aspnetcore-runtime-11.0 – 

11.0.0~rc3-0ubuntu1~26.10.1
dotnet-host-10.0 – 

10.0.14-0ubuntu1~26.10.1
dotnet-host-11.0 – 

11.0.0~rc3-0ubuntu1~26.10.1
dotnet-hostfxr-10.0 – 

10.0.14-0ubuntu1~26.10.1
dotnet-hostfxr-11.0 – 

11.0.0~rc3-0ubuntu1~26.10.1
dotnet-runtime-10.0 – 

10.0.14-0ubuntu1~26.10.1
dotnet-runtime-11.0 – 

11.0.0~rc3-0ubuntu1~26.10.1
dotnet-sdk-10.0 – 

10.0.114-0ubuntu1~26.10.1
dotnet-sdk-11.0 – 

11.0.100~rc3-0ubuntu1~26.10.1
dotnet-sdk-aot-10.0 – 

10.0.114-0ubuntu1~26.10.1
dotnet-sdk-aot-11.0 – 

11.0.100~rc3-0ubuntu1~26.10.1
dotnet-sdk-dbg-10.0 – 

10.0.114-0ubuntu1~26.10.1
dotnet-sdk-dbg-11.0 – 

11.0.100~rc3-0ubuntu1~26.10.1
dotnet10 – 

10.0.114-10.0.14-0ubuntu1~26.10.1
dotnet11 – 

11.0.100-11.0.0~rc3-0ubuntu1~26.10.1
26.04

LTS resolute

 aspnetcore-runtime-10.0 – 

10.0.14-0ubuntu1~26.04.1
dotnet-host-10.0 – 

10.0.14-0ubuntu1~26.04.1
dotnet-hostfxr-10.0 – 

10.0.14-0ubuntu1~26.04.1
dotnet-runtime-10.0 – 

10.0.14-0ubuntu1~26.04.1
dotnet-sdk-10.0 – 

10.0.114-0ubuntu1~26.04.1
dotnet-sdk-aot-10.0 – 

10.0.114-0ubuntu1~26.04.1
dotnet-sdk-dbg-10.0 – 

10.0.114-0ubuntu1~26.04.1
dotnet10 – 

10.0.114-10.0.14-0ubuntu1~26.04.1
24.04

LTS noble

 aspnetcore-runtime-10.0 – 

10.0.14-0ubuntu1~24.04.1
aspnetcore-runtime-8.0 – 

8.0.33-0ubuntu1~24.04.1
dotnet-host-10.0 – 

10.0.14-0ubuntu1~24.04.1
dotnet-host-8.0 – 

8.0.33-0ubuntu1~24.04.1
dotnet-hostfxr-10.0 – 

10.0.14-0ubuntu1~24.04.1
dotnet-hostfxr-8.0 – 

8.0.33-0ubuntu1~24.04.1
dotnet-runtime-10.0 – 

10.0.14-0ubuntu1~24.04.1
dotnet-runtime-8.0 – 

8.0.33-0ubuntu1~24.04.1
dotnet-sdk-10.0 – 

10.0.114-0ubuntu1~24.04.1
dotnet-sdk-8.0 – 

8.0.133-0ubuntu1~24.04.1
dotnet-sdk-aot-10.0 – 

10.0.114-0ubuntu1~24.04.1
dotnet-sdk-dbg-10.0 – 

10.0.114-0ubuntu1~24.04.1
dotnet10 – 

10.0.114-10.0.14-0ubuntu1~24.04.1
dotnet8 – 

8.0.133-8.0.33-0ubuntu1~24.04.1
22.04

LTS jammy

 aspnetcore-runtime-8.0 – 

8.0.33-0ubuntu1~22.04.1
dotnet-host-8.0 – 

8.0.33-0ubuntu1~22.04.1
dotnet-hostfxr-8.0 – 

8.0.33-0ubuntu1~22.04.1
dotnet-runtime-8.0 – 

8.0.33-0ubuntu1~22.04.1
dotnet-sdk-8.0 – 

8.0.133-0ubuntu1~22.04.1
dotnet8 – 

8.0.133-8.0.33-0ubuntu1~22.04.1

Frequently Asked Questions

What is USN-8958-1?
It is Ubuntu's security notice fixing three .NET CVEs: CVE-2026-102870, CVE-2026-111497 and CVE-2026-114148 — including a Blazor WebAssembly debug-proxy flaw allowing arbitrary code execution (CWE-94), aggregate CVSS 8.8.
Why is CVE-2026-111497 being fixed again?
The fix for CVE-2026-111497 was originally released in USN-8942-1, but was found to be incomplete — this notice re-delivers the complete fix. If you patched when USN-8942-1 shipped, apply this update as well; the earlier one did not fully close the flaw.
Who is affected?
Ubuntu systems with .NET / ASP.NET Core packages installed — Ubuntu 26.10 per the notice's package list, with the earlier USN covering other supported releases. .NET applications using Blazor WebAssembly are the exposed surface for the debug-proxy flaw.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade (the notice lists aspnetcore-runtime and dotnet-host package versions for 26.10), then restart your .NET applications so they run the patched runtime.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System