{"schemaVersion":3,"id":"USN-8085-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"dotnet8, dotnet9, dotnet10 vulnerabilities\n\nIt was discovered that the .NET Microsoft.Bcl.Memory NuGet package did not\nproperly handle certain malformed Base64Url encoded input. An attacker could\npossibly use this issue to cause .NET to crash, resulting in a denial of\nservice. This issue only affected .NET 9.0 and .NET 10.0. (CVE-2026-26127)\n\nBartłomiej Dach discovered that .NET's SignalR server component did not\nproperly manage resource consumption when processing certain messages. An\nattacker could possibly use this issue to exhaust internal buffers, resulting\nin a denial of service. (CVE-2026-26130)","dates":{"published":"2026-03-11T16:50:26.000Z","modified":"2026-06-30T18:15:34.251Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"dotnet10","name":"dotnet10","label":"dotnet10","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet10","purlType":"deb","versions":[{"text":"< 10.0.104-10.0.4-0ubuntu1~24.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 10.0.104-10.0.4-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.0.104-10.0.4-0ubuntu1~24.04.1 | < 10.0.104-10.0.4-0ubuntu1~25.10.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet8","name":"dotnet8","label":"dotnet8","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet8","purlType":"deb","versions":[{"text":"< 8.0.125-8.0.25-0ubuntu1~22.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.0.125-8.0.25-0ubuntu1~24.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.0.125-8.0.25-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.125-8.0.25-0ubuntu1~22.04.1 | < 8.0.125-8.0.25-0ubuntu1~24.04.1 | < 8.0.125-8.0.25-0ubuntu1~25.10.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet9","name":"dotnet9","label":"dotnet9","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet9","purlType":"deb","versions":[{"text":"< 9.0.115-9.0.14-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.115-9.0.14-0ubuntu1~25.10.1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8085-1","label":"ubuntu.com/security/notices/USN-8085-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-26127","label":"ubuntu.com/security/CVE-2026-26127","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-26130","label":"ubuntu.com/security/CVE-2026-26130","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2026-26127","CVE-2026-26130"]},"timeline":[{"kind":"published","date":"2026-03-11T16:50:26.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-30T18:15:34.251Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T15:30:15.489Z","stale":false,"partial":false}}