Red Hat Product Errata RHSA-2026:28051 - Security Advisory Issued: 2026-06-22 Updated: 2026-06-29 RHSA-2026:28051 - Security Advisory Overview Updated Packages Synopsis Important: .NET 9.0 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for .NET 9.0 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17. Security Fix(es): dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2487164 - CVE-2026-45491 dotnet: .NET: Local file tampering via link following vulnerability BZ - 2487224 - CVE-2026-45591 dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption CVEs CVE-2026-45491 CVE-2026-45591 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM dotnet9.0-9.0.118-1.el9_6.src.rpm SHA-256: 18e0409f73161f85baef182d73db3904c6a200c6cdeaf79182246c19056353bb x86_64 aspnetcore-runtime-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: c072620b3d59d952a833d771b5e141872618821ac117a12ca87deeda45cf1704 aspnetcore-runtime-dbg-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 60702588bd3dc8b6d9ba6d1c3ff58dadbb3ed2011d3f7db66b10c52334821fa1 aspnetcore-targeting-pack-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 6588248fcabcd563a3ba59b46b62f5f1a03e02a7d808af657cb6160e02443d42 dotnet-apphost-pack-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 06e1fd5ba63bb7e09cca8810d062b2e4d4e36f65d44a16618e165ed9abe82611 dotnet-apphost-pack-9.0-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: 42f25b968cad65acf610ca7838b57ce869d4d699e8ca8a8972125c5c13a51ef8 dotnet-host-9.0.17-1.el9_6.x86_64.rpm SHA-256: 6ac8784ef57a9d7bd8be8f327454da08fd30cdf06f3ae312c76d10f2a0f860cf dotnet-host-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: b48046531225c75c8dc6b003d8e6c3d81c9ab50fa73109e21a14bea70f22a0a7 dotnet-hostfxr-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 5a9421903b3dbab264ab9a34f5ea1a746b5ba3f0e9c3d914787e41be0792cf3f dotnet-hostfxr-9.0-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: 7f77d4ccb7a0edbf0910e4fb9e5a8f6e5ed3fb63741f7646c3964323bdbb1aa5 dotnet-runtime-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 49a8e307eec75b75fcfd26e3eab9c386ca62d37d4a0e16d1dff50cc9084ff77f dotnet-runtime-9.0-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: a04128af4bce6b1dc698c17a556678fb677fc22ce8803ddce16957d0795a8533 dotnet-runtime-dbg-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: e2750e587d50f0d159a657e0f25cdf0f0b590b40fa5283300b28b38b75fc334a dotnet-sdk-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: 542c684813c2894a5bf83e7f713d1dc4744c8d214a94217c1328dd90ee94f5b7 dotnet-sdk-9.0-debuginfo-9.0.118-1.el9_6.x86_64.rpm SHA-256: 409e99a216c94fd5899595fbaf13d8a3975ca38a6e7eeff99cf6c7194d0a4c1a dotnet-sdk-aot-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: 8318a3c7e70fc53d26c8be4712cab1233e4ea1a9e21ec99a7dad500d28096d30 dotnet-sdk-aot-9.0-debuginfo-9.0.118-1.el9_6.x86_64.rpm SHA-256: fc77ad5d87876c5014f8314b436f11ed52af607e1e1ed742795c56abe45080e5 dotnet-sdk-dbg-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: d0c788050d8c7862a27ad452c6cfaa46bed872b729f36aa70211f7dc4481d818 dotnet-targeting-pack-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 752e0fb5f70b404253dbc9366b35ff08d1f57c146ac4ccf0cfffe1d901d0a546 dotnet-templates-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: e201df3249791ec7c21b90193b6b97c4302b51bdb1c5940b24217917cd4bb869 dotnet9.0-debuginfo-9.0.118-1.el9_6.x86_64.rpm SHA-256: e10b64ac3cb7ffa78d6c2cb2ba1f94fccbb40784db6a690c1c5b2c053f484f1e dotnet9.0-debugsource-9.0.118-1.el9_6.x86_64.rpm SHA-256: 4a580a80b1ca6eac3298c96297ff78524fd81e37cc8fc7f05c062a633abdbe02 netstandard-targeting-pack-2.1-9.0.118-1.el9_6.x86_64.rpm SHA-256: a7370b1dea0173c0d58e680d3988c4abe4a1db4835ded50fe31b63007205ea27 Red Hat Enterprise Linux Server - AUS 9.6 SRPM dotnet9.0-9.0.118-1.el9_6.src.rpm SHA-256: 18e0409f73161f85baef182d73db3904c6a200c6cdeaf79182246c19056353bb x86_64 aspnetcore-runtime-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: c072620b3d59d952a833d771b5e141872618821ac117a12ca87deeda45cf1704 aspnetcore-runtime-dbg-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 60702588bd3dc8b6d9ba6d1c3ff58dadbb3ed2011d3f7db66b10c52334821fa1 aspnetcore-targeting-pack-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 6588248fcabcd563a3ba59b46b62f5f1a03e02a7d808af657cb6160e02443d42 dotnet-apphost-pack-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 06e1fd5ba63bb7e09cca8810d062b2e4d4e36f65d44a16618e165ed9abe82611 dotnet-apphost-pack-9.0-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: 42f25b968cad65acf610ca7838b57ce869d4d699e8ca8a8972125c5c13a51ef8 dotnet-host-9.0.17-1.el9_6.x86_64.rpm SHA-256: 6ac8784ef57a9d7bd8be8f327454da08fd30cdf06f3ae312c76d10f2a0f860cf dotnet-host-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: b48046531225c75c8dc6b003d8e6c3d81c9ab50fa73109e21a14bea70f22a0a7 dotnet-hostfxr-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 5a9421903b3dbab264ab9a34f5ea1a746b5ba3f0e9c3d914787e41be0792cf3f dotnet-hostfxr-9.0-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: 7f77d4ccb7a0edbf0910e4fb9e5a8f6e5ed3fb63741f7646c3964323bdbb1aa5 dotnet-runtime-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 49a8e307eec75b75fcfd26e3eab9c386ca62d37d4a0e16d1dff50cc9084ff77f dotnet-runtime-9.0-debuginfo-9.0.17-1.el9_6.x86_64.rpm SHA-256: a04128af4bce6b1dc698c17a556678fb677fc22ce8803ddce16957d0795a8533 dotnet-runtime-dbg-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: e2750e587d50f0d159a657e0f25cdf0f0b590b40fa5283300b28b38b75fc334a dotnet-sdk-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: 542c684813c2894a5bf83e7f713d1dc4744c8d214a94217c1328dd90ee94f5b7 dotnet-sdk-9.0-debuginfo-9.0.118-1.el9_6.x86_64.rpm SHA-256: 409e99a216c94fd5899595fbaf13d8a3975ca38a6e7eeff99cf6c7194d0a4c1a dotnet-sdk-aot-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: 8318a3c7e70fc53d26c8be4712cab1233e4ea1a9e21ec99a7dad500d28096d30 dotnet-sdk-aot-9.0-debuginfo-9.0.118-1.el9_6.x86_64.rpm SHA-256: fc77ad5d87876c5014f8314b436f11ed52af607e1e1ed742795c56abe45080e5 dotnet-sdk-dbg-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: d0c788050d8c7862a27ad452c6cfaa46bed872b729f36aa70211f7dc4481d818 dotnet-targeting-pack-9.0-9.0.17-1.el9_6.x86_64.rpm SHA-256: 752e0fb5f70b404253dbc9366b35ff08d1f57c146ac4ccf0cfffe1d901d0a546 dotnet-templates-9.0-9.0.118-1.el9_6.x86_64.rpm SHA-256: e201df3249791ec7c21b90193b6b97c4302b51bdb1c5940b24217917cd4bb869 dotnet9.0-debuginfo-9.0.118-1.el9_6.x86_64.rpm SHA-256: e10b64ac3cb7ffa78d6c2cb2ba1f94fccbb40784db6a690c1c5b2c053f484f1e dotnet9.0-debugsource-9.0.118-1.el9_6.x86_64.rpm SHA-256: 4a580a80b1ca6eac3298c96297ff78524fd81e37cc8fc7f05c062a633abdbe02 netstandard-targeting-pack-2.1-9.0.118-1.el9_6.x86_64.rpm SHA-256: a7370b1dea0173c0d58e680d3988c4abe4a1db4835ded50fe31b63007205ea27 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 SRPM dotnet9.0-9.0.118-1.el9_6.src.rpm SHA-256: 18e0409f73161f85baef182d73db3904c6a200c6cdeaf79182246c19056353bb s390x aspnetcore-runtime-9.0-9.0.17-1.el9_6.s390x.rpm SHA-256: 4c79bab6f51f8229d1f8edc3494a766098f36f78901dc9d1585ab282346d13f8 aspnetcore-runtime-dbg-9.0-9.0.17-1.el9_6.s390x.rpm SHA-256: 1a3c271b2aa193c89c4aead7d12eccb71ea670f606c1cf6bc902362262a4f6b7 aspnetcore-targeting-pack-9.0-9.0.17-1.el9_6.s390x.rpm SHA-256: af9b9d9fd9b80b9d97c69ac99e5cf7c080ef289f0c863a52fe429574b6d0d753 dotnet-apphost-pack-9.0-9.0.17-1.el9_6.s390x.rpm SHA-256: 1d3794e0e3bdd175a04bd086d288dcd2e17432669f30efab9a17491c2b93df4c dotnet-apphost-pack-9.0-debuginfo-9.0.17-1.el9_6.s390x.rpm SHA-256: 5a6181ac402050a7d8d72952b55f93c15c4b0c9adc9ed0e217f3a77055cc3b61 dotnet-host-9.0.17-1