Threats Tagged 'cve-2026-42899'

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases. Security Fix(es): * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A denial of service vulnerability (CVE-2026-8723) exists in the qs library used in Red Hat Hardened Images RPMs. The flaw occurs when qs.stringify processes arrays containing null or undefined elements with specific configuration, causing a TypeError that crashes the application or returns a 500 error. This leads to denial of service for affected requests. Red Hat has released updated RPM packages including python3.14-3.14.6-1.1.hum1 to address this issue. No mitigation other than applying the update is currently recommended.

This update includes the following RPMs: dotnet10.0: * aspnetcore-runtime-10.0-10.0.8-1.hum1 (aarch64, x86_64) * aspnetcore-runtime-dbg-10.0-10.0.8-1.hum1 (aarch64, x86_64) * aspnetcore-targeting-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-apphost-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-host-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-hostfxr-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-runtime-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-runtime-dbg-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-sdk-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-10.0-source-built-artifacts-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-aot-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-sdk-dbg-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet-targeting-pack-10.0-10.0.8-1.hum1 (aarch64, x86_64) * dotnet-templates-10.0-10.0.108-1.hum1 (aarch64, x86_64) * dotnet10.0-10.0.108-1.hum1.src (src)

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.