This Red Hat security advisory (RHSA-2026:9080) covers a bug fix and enhancement update for Red Hat Hardened Images RPMs, specifically targeting dotnet8.0 packages across aarch64 and x86_64 architectures. Among the vulnerabilities addressed in the broader context is CVE-2025-55315, a significant security flaw in ASP.NET Core's HTTP request handling that causes inconsistent interpretation of specially crafted HTTP requests. This flaw enables HTTP request smuggling attacks by authorized network attackers, potentially bypassing security controls and exposing or manipulating request data. The advisory clarifies that .NET 6.0 for RHEL-8, RHEL-9, and RHIVOS is no longer supported and will not receive fixes. No direct fixes for these vulnerabilities are included in this update for the Hardened Images RPMs, and no mitigation is currently available that meets Red Hat's standards for ease of use and applicability. The advisory references multiple CVEs related to this update but does not provide explicit patch details for them within the Hardened Images context.

The primary impact involves the potential for authorized network attackers to exploit inconsistent HTTP request parsing in ASP.NET Core to perform HTTP request smuggling attacks. This can lead to bypassing security controls, unauthorized access, web cache poisoning, and unintended forwarding or manipulation of HTTP request data. The advisory indicates that these vulnerabilities affect Red Hat Hardened Images RPMs containing dotnet8.0 components. The lack of available fixes or effective mitigations increases the risk for affected users, especially those running unsupported .NET versions. No known exploits in the wild have been reported at this time.

Red Hat currently does not provide a fix for these vulnerabilities in the Hardened Images RPMs, and mitigation options are either unavailable or do not meet Red Hat's criteria for deployment. Users are advised to upgrade to supported product versions when available. For .NET 6.0 on RHEL-8, RHEL-9, and RHIVOS, which is end-of-life, no fixes will be provided, so upgrading to a supported .NET version is recommended. Users should monitor Red Hat advisories and apply updates from official sources as they become available. Consulting with Red Hat Technical Account Managers (TAM) is recommended for tailored guidance. No generic mitigations beyond upgrading or patching are suggested due to the nature of the vulnerabilities and the advisory content.