This Red Hat security advisory (RHSA-2026:39952) covers a bug fix and enhancement update for Red Hat Hardened Images RPMs, focusing on dotnet9.0 related packages. It addresses multiple vulnerabilities identified by CVE-2026-47300, CVE-2026-47303, and CVE-2026-56170. The update includes new versions of various dotnet9.0 RPMs such as aspnetcore-runtime, dotnet-runtime, dotnet-sdk, and targeting packs for both aarch64 and x86_64 architectures. The advisory does not specify exact affected versions or detailed technical vulnerability descriptions beyond referencing CWE identifiers (CWE-303, CWE-472, CWE-770). No patch links or explicit fixed versions are provided in the advisory content. The vendor has published the update and recommends applying it as per instructions on https://images.redhat.com/. There are no known exploits in the wild at this time.

The vulnerabilities addressed are rated high severity and involve multiple CVEs affecting Red Hat Hardened Images RPMs for dotnet9.0 components. The impact likely involves security weaknesses related to the CWEs listed (CWE-303: Incorrect Implementation, CWE-472: External Control of Assumed-Immutable Web Parameter, CWE-770: Allocation of Resources Without Limits or Throttling), which could affect the security posture of affected systems. However, no specific exploitation details or impact scenarios are provided. No known exploits have been reported in the wild, reducing immediate risk.

Red Hat has released updated RPM packages for dotnet9.0 components as part of this advisory. Users should apply the update following Red Hat's official guidance at https://images.redhat.com/. Since this is an official security advisory with updated packages available, applying these updates is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified or required beyond applying the update.