{"schemaVersion":3,"id":"USN-8553-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"dotnet8, dotnet10 vulnerabilities\n\nArtur Stetsko discovered that the .NET did not properly validate\nauthentication data. An attacker could possibly use this issue to elevate\nprivileges. (CVE-2026-47300)\n\nLevi Broderick discovered that .NET did not properly handle XML encryption\nduring parsing. An attacker could possibly use this issue to consume\nexcessive resources, resulting in a denial of service. (CVE-2026-47302)\n\nPham Quang Minh discovered that .NET did not properly parse\nauthentication data. An attacker could possibly use this issue to bypass\nauthentication and elevate privileges. (CVE-2026-47303)\n\nLevi Broderick discovered that .NET did not properly verify cryptographic\nsignatures during XML encryption. An attacker could possibly use this issue\nto bypass security features over a network and access encrypted data.\n(CVE-2026-47304)\n\nIt was discovered that .NET did not properly validate input during TLS\nhandshakes. An attacker could possibly use this issue to cause .NET to\ncrash, resulting in a denial of service. (CVE-2026-50524)\n\nLevi Broderick discovered that .NET did not properly handle resource\nallocation during XML encryption. An attacker could possibly use this issue\nto consume excessive resources, resulting in a denial of service.\n(CVE-2026-50525)\n\nSiwei Li discovered that .NET did not properly handle link resolution\nbefore file access during the container image build process. A local\nattacker could possibly use this issue to inject resources that could be\nincorporated into container images built by other users on the same\nmachine. (CVE-2026-50526)\n\nLevi Broderick discovered that .NET did not properly handle memory while\nperforming XML encryption. An attacker could possibly use this issue to\ncause .NET to crash, resulting in a denial of service. (CVE-2026-50527)\n\nHenrique Pereira discovered that .NET did not properly handle\nauthorization checks during TLS/SSL connections. An attacker could\npossibly use this issue to bypass authorization checks during secure\ncommunications. (CVE-2026-50528)\n\nIt was discovered that .NET did not properly handle resource allocation\nduring XML encryption. An attacker could possibly use this issue to\nconsume excessive resources, resulting in a denial of service.\n(CVE-2026-50648)\n\nMiha Zupan discovered that .NET did not properly limit resource\nallocation when handling HTTP/2 requests. An attacker could possibly use\nthis issue to consume excessive resources, resulting in a denial of\nservice. (CVE-2026-50651)\n\nIt was discovered that the .NET SMTP client did not properly handle the\nencoding or escaping of output. An attacker could possibly use this issue\nto spoof messages during message routing. (CVE-2026-50659)\n\nIt was discovered that .NET did not properly validate resource types when\nparsing X.509 certificates. An attacker could possibly use this issue to\ncause .NET to crash, resulting in a denial of service. (CVE-2026-57108)","dates":{"published":"2026-07-15T17:13:59.000Z","modified":"2026-07-27T16:23:15.485Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"dotnet10","name":"dotnet10","label":"dotnet10","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet10","purlType":"deb","versions":[{"text":"< 10.0.110-10.0.10-0ubuntu1~24.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 10.0.110-10.0.10-0ubuntu1~26.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.0.110-10.0.10-0ubuntu1~24.04.1 | < 10.0.110-10.0.10-0ubuntu1~26.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet8","name":"dotnet8","label":"dotnet8","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet8","purlType":"deb","versions":[{"text":"< 8.0.129-8.0.29-0ubuntu1~22.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.0.129-8.0.29-0ubuntu1~24.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.129-8.0.29-0ubuntu1~22.04.1 | < 8.0.129-8.0.29-0ubuntu1~24.04.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8553-1","label":"ubuntu.com/security/notices/USN-8553-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-47300","label":"ubuntu.com/security/CVE-2026-47300","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-47302","label":"ubuntu.com/security/CVE-2026-47302","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-47303","label":"ubuntu.com/security/CVE-2026-47303","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-47304","label":"ubuntu.com/security/CVE-2026-47304","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50524","label":"ubuntu.com/security/CVE-2026-50524","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50525","label":"ubuntu.com/security/CVE-2026-50525","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50526","label":"ubuntu.com/security/CVE-2026-50526","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50527","label":"ubuntu.com/security/CVE-2026-50527","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50528","label":"ubuntu.com/security/CVE-2026-50528","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50648","label":"ubuntu.com/security/CVE-2026-50648","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50651","label":"ubuntu.com/security/CVE-2026-50651","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-50659","label":"ubuntu.com/security/CVE-2026-50659","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-57108","label":"ubuntu.com/security/CVE-2026-57108","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2026-47300","CVE-2026-47302","CVE-2026-47303","CVE-2026-47304","CVE-2026-50524","CVE-2026-50525","CVE-2026-50526","CVE-2026-50527","CVE-2026-50528","CVE-2026-50648","CVE-2026-50651","CVE-2026-50659","CVE-2026-57108"]},"timeline":[{"kind":"published","date":"2026-07-15T17:13:59.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-27T16:23:15.485Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:53:53.981Z","stale":false,"partial":false}}