Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux .NET 8.0 allows spoofing attacks
published 1 year ago
Summary
The .NET 8.0 components for AlmaLinux can be tricked into showing false information, which could let attackers deceive users or other systems. Update to .NET SDK version 8.0.116 or Runtime version 8.0.16 as soon as possible to close the gap.
What to do
- Update almalinux aspnetcore-runtime-8.0 to version 8.0.16-1.el10_0.
- Update almalinux aspnetcore-runtime-dbg-8.0 to version 8.0.16-1.el10_0.
- Update almalinux aspnetcore-targeting-pack-8.0 to version 8.0.16-1.el10_0.
- Update almalinux dotnet-apphost-pack-8.0 to version 8.0.16-1.el10_0.
- Update almalinux dotnet-hostfxr-8.0 to version 8.0.16-1.el10_0.
- Update almalinux dotnet-runtime-8.0 to version 8.0.16-1.el10_0.
- Update almalinux dotnet-runtime-dbg-8.0 to version 8.0.16-1.el10_0.
- Update almalinux dotnet-sdk-8.0 to version 8.0.116-1.el10_0.
- Update almalinux dotnet-sdk-8.0-source-built-artifacts to version 8.0.116-1.el10_0.
- Update almalinux dotnet-sdk-dbg-8.0 to version 8.0.116-1.el10_0.
- Update almalinux dotnet-targeting-pack-8.0 to version 8.0.16-1.el10_0.
- Update almalinux dotnet-templates-8.0 to version 8.0.116-1.el10_0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | aspnetcore-runtime-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | aspnetcore-runtime-dbg-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | aspnetcore-targeting-pack-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-apphost-pack-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-hostfxr-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-runtime-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-runtime-dbg-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-sdk-8.0 |
< 8.0.116-1.el10_0 Fix: upgrade to 8.0.116-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-sdk-8.0-source-built-artifacts |
< 8.0.116-1.el10_0 Fix: upgrade to 8.0.116-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-sdk-dbg-8.0 |
< 8.0.116-1.el10_0 Fix: upgrade to 8.0.116-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-targeting-pack-8.0 |
< 8.0.16-1.el10_0 Fix: upgrade to 8.0.16-1.el10_0
|
| AlmaLinux:10 | almalinux | dotnet-templates-8.0 |
< 8.0.116-1.el10_0 Fix: upgrade to 8.0.116-1.el10_0
|
Original advisory text
Important: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es):
* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es):
* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:7599 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-26646 Third Party Advisory
- https://bugzilla.redhat.com/2365317 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2025-7599.html Vendor Advisory
Timeline
Published14 May 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:7599 · OSV
Track software like this
Free during beta