Red Hat Product Errata RHSA-2026:25113 - Security Advisory Issued: 2026-06-10 Updated: 2026-06-10 RHSA-2026:25113 - Security Advisory Overview Updated Packages Synopsis Important: .NET 9.0 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for .NET 9.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2487164 - CVE-2026-45491 dotnet: .NET: Local file tampering via link following vulnerability BZ - 2487224 - CVE-2026-45591 dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption CVEs CVE-2026-45491 CVE-2026-45591 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM dotnet9.0-9.0.118-1.el8_10.src.rpm SHA-256: 077ce3aaa5b6afaf3385ab6b4578f4f058b0a11c09d5c76b78b17496cc678d4f x86_64 aspnetcore-runtime-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: 0b156707c020037dddb41fba4d2830c305bd070fd318c59ae0403a59035a697c aspnetcore-runtime-dbg-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: 634ad39ab6e9c2c4397dd5607d2fce49b6669da6113f6ccb04bcfed67e04e413 aspnetcore-targeting-pack-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: 0e0bd18d880b6a956c924a14ba8418d27f2f7f9d4f8245d3b34af17df54c41d2 dotnet-apphost-pack-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: 8d724ab08706f8400077f16a3b090fa38c503e9de5df600ab1827f36e75fbbf1 dotnet-apphost-pack-9.0-debuginfo-9.0.17-1.el8_10.x86_64.rpm SHA-256: 9846891e0c5a5f1252f9e09612d402bec48e2dafc5f6d63e1d24fa120bf76ddc dotnet-hostfxr-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: 7da58b9f3839a84a2aef38da86118f91e3ea0909906f2664cf4c7211579dc9a4 dotnet-hostfxr-9.0-debuginfo-9.0.17-1.el8_10.x86_64.rpm SHA-256: 8fc0a1bdec26a5a9d98f4e6c21739a3b5f2293851e7c78d4f7a500c1ae447e6a dotnet-runtime-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: 99cb58e25b2f0f34e10ca91eb46f569c99910575d1eb0c9f3625fb03a5afe5a9 dotnet-runtime-9.0-debuginfo-9.0.17-1.el8_10.x86_64.rpm SHA-256: 97fad64e421643772a55c9f86e36ed5e916dc0f2136e9cf74a2d5c55e324ce1e dotnet-runtime-dbg-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: 4064c04553a8d0fe47e90b20921e91471ed461752511aff8841f22dbca41eac1 dotnet-sdk-9.0-9.0.118-1.el8_10.x86_64.rpm SHA-256: b433370a4c70e9b1a390f55902041ae56e6c05338331703a2c25544d32012ced dotnet-sdk-9.0-debuginfo-9.0.118-1.el8_10.x86_64.rpm SHA-256: 2db98a013fb3ed215fa753e123743e5333d01872d5b4e9f9f01525ed3e184412 dotnet-sdk-aot-9.0-9.0.118-1.el8_10.x86_64.rpm SHA-256: ae3a017c5d7f249f394eaf0cee01dce95f9e20c05e99dacca41faa00a69b731c dotnet-sdk-aot-9.0-debuginfo-9.0.118-1.el8_10.x86_64.rpm SHA-256: fd1b243ca149e3d9654d335006409cdce822b8e88f93a0f812685577bc1c793d dotnet-sdk-dbg-9.0-9.0.118-1.el8_10.x86_64.rpm SHA-256: f0ecb8717ddd765d3002f85a502d1ff9eb82b654a154d90a35d7ddcb64434024 dotnet-targeting-pack-9.0-9.0.17-1.el8_10.x86_64.rpm SHA-256: cd7b172a5af91b4f54cffded15ac8da0999e2c180cb432fc4c292f6762c37299 dotnet-templates-9.0-9.0.118-1.el8_10.x86_64.rpm SHA-256: 70875d355914a7a9cf8664821b4aec9440760d5d5896fdf5ba52ad7998a54dca dotnet9.0-debuginfo-9.0.118-1.el8_10.x86_64.rpm SHA-256: 8535ffb4742d73391e4a7478a94ee01ea143403b5a07b5e7beac04de70cdbd11 dotnet9.0-debugsource-9.0.118-1.el8_10.x86_64.rpm SHA-256: 7928842295c9132a68fec6402e32acadb8ca8331d0fc6409fb5787bcb467655b netstandard-targeting-pack-2.1-9.0.118-1.el8_10.x86_64.rpm SHA-256: b8608866568ee614d7b41bced4af5b7fbc43a6b698497d7d808f6d8d5a12d924 Red Hat Enterprise Linux for IBM z Systems 8 SRPM dotnet9.0-9.0.118-1.el8_10.src.rpm SHA-256: 077ce3aaa5b6afaf3385ab6b4578f4f058b0a11c09d5c76b78b17496cc678d4f s390x aspnetcore-runtime-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: c6936e9b5385af75db8a63137c325dab9dfc615c975f580bf7a35d00b875560d aspnetcore-runtime-dbg-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: 18299d98c09bca06252873ddf107b5ddd5586ba990991c3bffddba0d1a42f4fb aspnetcore-targeting-pack-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: f281ce95a3fc0243626ecf980b72690e3267eee8d775210589d87676481b7069 dotnet-apphost-pack-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: 329f7e49002842e0322edc3f1fc0bb60432fee76888c33c1efd2cb8e81a87a40 dotnet-apphost-pack-9.0-debuginfo-9.0.17-1.el8_10.s390x.rpm SHA-256: 8b57c5454b0e5ad31e7a400553f2b225dab3f8bc725cf0e13019827146da08f1 dotnet-hostfxr-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: 45274fce280024185cc01855a3f206e50d288e3ce5e80349e621778b5b00fcd2 dotnet-hostfxr-9.0-debuginfo-9.0.17-1.el8_10.s390x.rpm SHA-256: 7a1f7ccbcfa079b51cead635fe917ffe9bf1a616b30c785a4a4305c47052a5d5 dotnet-runtime-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: b24e4c56af3013f18cdddcb4c89e67530f9231bde33c89ac965ad9e9210a58ad dotnet-runtime-9.0-debuginfo-9.0.17-1.el8_10.s390x.rpm SHA-256: a080c42fdbf69870bb6f36be88982f402fae9d4f0bddeecb12f38f12e50a2217 dotnet-runtime-dbg-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: 9d8fa8389ab1b096f3d436fd8f21477b37ac6707df5078a5b1774c5cb197545c dotnet-sdk-9.0-9.0.118-1.el8_10.s390x.rpm SHA-256: 739a936992567f61fb8b48b63ba13d7282e47588bd4a23a1e5bb02c180ff9efd dotnet-sdk-9.0-debuginfo-9.0.118-1.el8_10.s390x.rpm SHA-256: e281c2be0b6332ab65b1aba0818c26e8a257cc55505e828928e34a73f46a94e1 dotnet-sdk-dbg-9.0-9.0.118-1.el8_10.s390x.rpm SHA-256: fea7f4e292d5640831001d949bdfbfd2fe5227f20a9fd6af04e9d0bbe4a53f68 dotnet-targeting-pack-9.0-9.0.17-1.el8_10.s390x.rpm SHA-256: 962239c2fa6c6692f97e7476230e5b54d36568cb2a352fb963cd5bec9506982e dotnet-templates-9.0-9.0.118-1.el8_10.s390x.rpm SHA-256: 66afd3521a282760ec44d1f3fc1f232de76ab405a8698f3a28795f3cb390d965 dotnet9.0-debuginfo-9.0.118-1.el8_10.s390x.rpm SHA-256: 4bc47490b0bdb5f0b100852fbe05accd653eeb093f26611eb103824992157207 dotnet9.0-debugsource-9.0.118-1.el8_10.s390x.rpm SHA-256: b73eb8fd7b9d33fb6f100b3fa72410a5197097381a2460c04603455d72d67f8f netstandard-targeting-pack-2.1-9.0.118-1.el8_10.s390x.rpm SHA-256: 391f5e4d479e04213b444ca07ce77117fc9b2b8b4d49e0ead34415b9899db827 Red Hat Enterprise Linux for Power, little endian 8 SRPM dotnet9.0-9.0.118-1.el8_10.src.rpm SHA-256: 077ce3aaa5b6afaf3385ab6b4578f4f058b0a11c09d5c76b78b17496cc678d4f ppc64le aspnetcore-runtime-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: 81578f3cc2caa2215f27367b032f0eb2f834814bdda6ae671b4e7909f9df2fa4 aspnetcore-runtime-dbg-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: 5c6a04ca6c8d014ca6fcf9265fe194b127f7267d2156cdca01ca8271caaee939 aspnetcore-targeting-pack-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: bd1a5013d185b750a52ffd5b18c7b8bc1e8d48ea6b24587c3826d7e82544c85e dotnet-apphost-pack-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: 93ebd4517cad0ca044ea1a5bb2dc102482b8140dcad395df4e5efcd7c07c4d48 dotnet-apphost-pack-9.0-debuginfo-9.0.17-1.el8_10.ppc64le.rpm SHA-256: d97d05373a5c408cd70866045c289e7026fc198790e0e75c2d064d159bd4b905 dotnet-hostfxr-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: 95d0665715283ff43319cc8d74623dd7f9547d08e991bba1a9495ee0be0997c0 dotnet-hostfxr-9.0-debuginfo-9.0.17-1.el8_10.ppc64le.rpm SHA-256: fe2313a272ca89e9d1eab55230fbb8a8116b4d131b11d5e73199b8d4fc092fce dotnet-runtime-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: 22d87b137c2e273e9cadbb787d52c7befaf492eda93a28b3be80b2b9e9803ff8 dotnet-runtime-9.0-debuginfo-9.0.17-1.el8_10.ppc64le.rpm SHA-256: c9b3210a97d1ab17873129f4a07e17300f632740dde5c897d416fc9070933adf dotnet-runtime-dbg-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: a7333988de68bb80fa2cfda9bacc77942081588182ba69bd2664326e2e5b00b0 dotnet-sdk-9.0-9.0.118-1.el8_10.ppc64le.rpm SHA-256: 6e4e6401b1206bfadac63d7e64ffa8adf612f33a1a89ed232e5a416f2dbe9538 dotnet-sdk-9.0-debuginfo-9.0.118-1.el8_10.ppc64le.rpm SHA-256: 6c736eca265aaa3c8d23157968580d45701a5eda278998879ce8fbf1224e96f7 dotnet-sdk-dbg-9.0-9.0.118-1.el8_10.ppc64le.rpm SHA-256: d5dd426a3130ee95a8d3cc008e12b4b8ca3d994a43ac68b3c6bbf4b852e7c9ca dotnet-targeting-pack-9.0-9.0.17-1.el8_10.ppc64le.rpm SHA-256: 68af592ab3393b61a2d19a3720ffa8d9b139753e851c11662c9089047cd14dc6 dotnet-templates-9.0-9.0.118-1.el8_10.ppc64le.rpm SHA-256: 255e08144d4039a34d764e7b31822fb5ae2e5ce8f59a37b715ebe99b411f5a04 dotnet9.0-debuginfo-9.0.118-1.el8_10.ppc64le.rpm SHA-256: e0b16d079e81d55ad0dc13f521da3d65ff1be5506875a0cef9237