Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
This update includes the following RPMs: dotnet10.0: * aspnetcore-runtime-10.0-10.0.8-1.hum1 (aarch64, x86_64) * aspnetcore-runtime-dbg-10.0-10.0.8-1.hum1 (aarch64, x86_64) * aspnetcore-targeting-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-apphost-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-host-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-hostfxr-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-runtime-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-runtime-dbg-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-sdk-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-10.0-source-built-artifacts-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-aot-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-dbg-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-targeting-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-templates-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet10.0-10.0.108-1.hum1.src (src)
AI Analysis
Technical Summary
CVE-2026-42899 is an infinite loop vulnerability in ASP.NET Core within the dotnet8.0 packages distributed by Red Hat Hardened Images. This flaw allows an unauthenticated remote attacker to trigger a denial of service condition by causing the application to enter an infinite loop, leading to excessive CPU and memory consumption and potential application crashes. The vulnerability is rated with high severity by Red Hat and has a CVSS v3.1 base score of 7.5. Red Hat has released an official fix for this issue in updated RPM packages for architectures aarch64 and x86_64. No known practical mitigations exist other than applying the update.
Potential Impact
The vulnerability enables an unauthenticated remote attacker to cause a denial of service by triggering an infinite loop in ASP.NET Core, resulting in high CPU and memory usage and potential application crashes. This can degrade service availability and impact systems running affected Red Hat Hardened Images with dotnet8.0 components.
Mitigation Recommendations
An official fix is available from Red Hat and should be applied as soon as possible to remediate this vulnerability. Red Hat has not identified any practical mitigations other than updating the affected packages. Users should follow Red Hat's update instructions for the relevant dotnet8.0 RPMs.
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
This update includes the following RPMs: dotnet10.0: * aspnetcore-runtime-10.0-10.0.8-1.hum1 (aarch64, x86_64) * aspnetcore-runtime-dbg-10.0-10.0.8-1.hum1 (aarch64, x86_64) * aspnetcore-targeting-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-apphost-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-host-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-hostfxr-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-runtime-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-runtime-dbg-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-sdk-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-10.0-source-built-artifacts-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-aot-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-dbg-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-targeting-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-templates-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet10.0-10.0.108-1.hum1.src (src)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42899 is an infinite loop vulnerability in ASP.NET Core within the dotnet8.0 packages distributed by Red Hat Hardened Images. This flaw allows an unauthenticated remote attacker to trigger a denial of service condition by causing the application to enter an infinite loop, leading to excessive CPU and memory consumption and potential application crashes. The vulnerability is rated with high severity by Red Hat and has a CVSS v3.1 base score of 7.5. Red Hat has released an official fix for this issue in updated RPM packages for architectures aarch64 and x86_64. No known practical mitigations exist other than applying the update.
Potential Impact
The vulnerability enables an unauthenticated remote attacker to cause a denial of service by triggering an infinite loop in ASP.NET Core, resulting in high CPU and memory usage and potential application crashes. This can degrade service availability and impact systems running affected Red Hat Hardened Images with dotnet8.0 components.
Mitigation Recommendations
An official fix is available from Red Hat and should be applied as soon as possible to remediate this vulnerability. Red Hat has not identified any practical mitigations other than updating the affected packages. Users should follow Red Hat's update instructions for the relevant dotnet8.0 RPMs.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:21297
- Cve Count
- 1
- Cvss Version
- 3.1
- Remediation Level
- official-fix
- State
- PUBLISHED
Threat ID: 6a175ecfe29bf47b50ed7f84
Added to database: 05/27/2026, 21:14:55 UTC
Last enriched: 08/16/2026, 18:04:48 UTC
Last updated: 09/13/2026, 22:01:34 UTC
Views: 101
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.