Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
.NET 8.0: Malicious Code Can Crash Your System
published 5 months ago
Summary
If you're using .NET 8.0, update to .NET SDK 8.0.127 and .NET Runtime 8.0.27 to prevent hackers from crashing your system with specially crafted code. This update is essential to maintain the security and stability of your .NET applications.
What to do
- Update rocky dotnet8.0 to version 0:8.0.127-1.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:8 | rocky | dotnet8.0 |
< 0:8.0.127-1.el8_10 Fix: upgrade to 0:8.0.127-1.el8_10
|
Original advisory text
Important: .NET 8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):
* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)
* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):
* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)
* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:21291 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2453284 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2476605 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published29 May 2026
Updated29 May 2026
First seen29 May 2026
Sources
RLSA-2026:21291 · OSV
Track software like this
Free during beta