Red Hat Product Errata RHSA-2026:28007 - Security Advisory Issued: 2026-06-22 Updated: 2026-06-22 RHSA-2026:28007 - Security Advisory Overview Updated Packages Synopsis Important: .NET 8.0 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for .NET 8.0 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28. Security Fix(es): dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2487164 - CVE-2026-45491 dotnet: .NET: Local file tampering via link following vulnerability BZ - 2487224 - CVE-2026-45591 dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption CVEs CVE-2026-45491 CVE-2026-45591 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM dotnet8.0-8.0.128-1.el10_0.src.rpm SHA-256: b58a1d23a241817676ab3d3df62a32277dadea9f2479b49e73bfcaf31e251470 x86_64 aspnetcore-runtime-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: c81f9056b72c4dbd6cf31c80f2c0a13b3df46938c6068a35a8f6762c486d7ba3 aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: 5da99630139be126c91e649dd30c1b44067206234ddbbee33d1e946f3d68a401 aspnetcore-targeting-pack-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: 0c7cfb4ffdebe570bdc9d1707cf715a5d27f936f21d73deae53288a408f2ae59 dotnet-apphost-pack-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: edd33dfc931d38d36b18be6e94c4cd4b6e864636419f33a59620c685a0509202 dotnet-apphost-pack-8.0-debuginfo-8.0.28-1.el10_0.x86_64.rpm SHA-256: 5f6a2b9ec80a567cc947bde799436e24353bd224332027b22e3b8488dee07ed7 dotnet-hostfxr-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: 1360d868dbf4ba6c76e2970c7f07e34f17b136e96fa69fc9fa721389f204c846 dotnet-hostfxr-8.0-debuginfo-8.0.28-1.el10_0.x86_64.rpm SHA-256: c3010d128f90337979e09035e96d6709a6d92d60e65368285fb31e1fe4ae315d dotnet-runtime-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: fc6aee6077b95656227ed260d8ee23bc964c170bc399529674dcce4b41d48769 dotnet-runtime-8.0-debuginfo-8.0.28-1.el10_0.x86_64.rpm SHA-256: 7f0f270c46ea3b42d4ca3f00199bff83c39b6737d20f71b565940258f193be61 dotnet-runtime-dbg-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: e935f95715def7b0e92f598131ee857271ad219b4eb905bd060d3f24acebcd2b dotnet-sdk-8.0-8.0.128-1.el10_0.x86_64.rpm SHA-256: 4d916f56443fb8704dcd6ba1898bbef54ba9e662bfab27c91605851ac9d3bff2 dotnet-sdk-8.0-debuginfo-8.0.128-1.el10_0.x86_64.rpm SHA-256: fe897b64a6f988132b9b671621dd10b66e35e4f9066152dba63e38a121916fc2 dotnet-sdk-dbg-8.0-8.0.128-1.el10_0.x86_64.rpm SHA-256: e27747c5f2ba9bcb1f800891b6e5ad0dfd7d98b8513928625eedd29d4793c3c3 dotnet-targeting-pack-8.0-8.0.28-1.el10_0.x86_64.rpm SHA-256: 9f25f4b8789167d9d7cfc2f140c4862d6110f70e15982b74e7015dd5db0f328b dotnet-templates-8.0-8.0.128-1.el10_0.x86_64.rpm SHA-256: 83c8203ecad265df28473a6693905dc6ca9c4ddccec7965f002107fa4d477f2b dotnet8.0-debugsource-8.0.128-1.el10_0.x86_64.rpm SHA-256: 252d07f8409c5330ae0c736f066a2aabf1bfb89de512814a493445cfeeba0561 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM dotnet8.0-8.0.128-1.el10_0.src.rpm SHA-256: b58a1d23a241817676ab3d3df62a32277dadea9f2479b49e73bfcaf31e251470 s390x aspnetcore-runtime-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: a63ad9298bde60908b8caa3c03587cbc69f6e5e62726d6b17123ff449885ddae aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: dd33df24e81430fa07d098b727a1e532fac6c4b2315c5e78f041f940431d245d aspnetcore-targeting-pack-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: b4800a5d005b9d6a1e862100acebac963ac83d714ffd09c76bff6e6dedfe3667 dotnet-apphost-pack-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: 73da31619721a2eb033130c123f01ca40b7bb26c52867f1c7fc5d7571879fa88 dotnet-apphost-pack-8.0-debuginfo-8.0.28-1.el10_0.s390x.rpm SHA-256: 6f8cc7cae2529f459cc07b3d7b146e7e4c9e80f18fd704297412253b1099396c dotnet-hostfxr-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: 04f2f0e279f2ef50847576acf7e46379793cedd7da153f2a5a5075dd6ee08144 dotnet-hostfxr-8.0-debuginfo-8.0.28-1.el10_0.s390x.rpm SHA-256: 9b94eeb169cd16e5f8fcaaee02b4e7fa186d479950df89d44717cc2da652d059 dotnet-runtime-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: 8454479daab31f01cc248cbb78360e776fb8f7a67ca08f7f1f26689a85c54720 dotnet-runtime-8.0-debuginfo-8.0.28-1.el10_0.s390x.rpm SHA-256: b27e61f7fabf8df6cfbb1713a14c3f61f624abe831d6131b6bfc28cce33d7850 dotnet-runtime-dbg-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: 96fe81319e518702589ce9d61eb9b995ab8465cdc0960d61f9503178fdf02d0a dotnet-sdk-8.0-8.0.128-1.el10_0.s390x.rpm SHA-256: b0a6d649ea32b7300f659b572eebe35a44f4cd297c5fc1c34524b801a533f355 dotnet-sdk-8.0-debuginfo-8.0.128-1.el10_0.s390x.rpm SHA-256: 39911bbeccbce21f80cfe2f165a973e05fb2e90776105c82668041b4d032a19c dotnet-sdk-dbg-8.0-8.0.128-1.el10_0.s390x.rpm SHA-256: 08954e0b2dad9d1211fb043b71f395a9736daa6b954ba3659dc93ebeb1cdffa1 dotnet-targeting-pack-8.0-8.0.28-1.el10_0.s390x.rpm SHA-256: 6af02c47ed58543ed19534de113910dc6d5c3e0b63a99995f4a08d9e0de50b4c dotnet-templates-8.0-8.0.128-1.el10_0.s390x.rpm SHA-256: ae173e901fd11194cca900108810fcd37e2e1070c8d44c265525ecaf16da7dd2 dotnet8.0-debugsource-8.0.128-1.el10_0.s390x.rpm SHA-256: f10fc712469af698c3b56db8e89bd9f05f4fa75becc366de22b9944d608cf7e0 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 SRPM dotnet8.0-8.0.128-1.el10_0.src.rpm SHA-256: b58a1d23a241817676ab3d3df62a32277dadea9f2479b49e73bfcaf31e251470 ppc64le aspnetcore-runtime-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 2b7264551ab4ffaae1f9c8ab1060ce85bd1b648b4d4a47495c264eae2444e371 aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 5cb991d86dcac5ffabeeefcb4cf824f95290585710c41ee0a1ee3aa94f1e3aa0 aspnetcore-targeting-pack-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 6656f01502e2cf17101ca34d6eadb126628571bbe5f70647dae1d4f07c62c59c dotnet-apphost-pack-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 283ef6f04de0012162b243e9806bf06ae27c142e05ac5748e67d20d83beb47d1 dotnet-apphost-pack-8.0-debuginfo-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 3db1b29a37e52b45600566f66651986e7b120c82fc2c3d93c74c506388fd8d71 dotnet-hostfxr-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 7b9a6c1a820d6a6925bb464eb9162dc19f9eeeb95e5723a4f7636d2bdc4c4c9b dotnet-hostfxr-8.0-debuginfo-8.0.28-1.el10_0.ppc64le.rpm SHA-256: c4961a2c595877ba471be89751a323de88c4c55d098f35f84ca8437524a61325 dotnet-runtime-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: d1139a7cb4ffdc9f46cb3851e333a8922b821c0117c4870ef287b37fde3c059a dotnet-runtime-8.0-debuginfo-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 6f64aa180975920375574ee0ebddccbbd3140a534335a9a692a1b3c4d0d5c6bf dotnet-runtime-dbg-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 503ad040fb10be9f53fbc21b311dcc5bb2f5fb51521b91efa5cf2c72ca0e706f dotnet-sdk-8.0-8.0.128-1.el10_0.ppc64le.rpm SHA-256: 261fb10bb78fadd6237be559a7a9108970fca9db5f40c31a05defb9845bcd990 dotnet-sdk-8.0-debuginfo-8.0.128-1.el10_0.ppc64le.rpm SHA-256: 1b5ac310638aef2d121122859bb87c5a87bb09eb0264dd57edf54d81205d4365 dotnet-sdk-dbg-8.0-8.0.128-1.el10_0.ppc64le.rpm SHA-256: 09d7677647dd8bf92cb7e9c56782203b4246117995e41b3837d56eaa920c026f dotnet-targeting-pack-8.0-8.0.28-1.el10_0.ppc64le.rpm SHA-256: 5ca676c1628140c7c7ab4fb4d551ab4a7f8ca97c1091ff2c267a915080e83a00 dotnet-templates-8.0-8.0.128-1.el10_0.ppc64le.rpm SHA-256: c4dea879817f03e90faf99cfb8284c940cc2105c857413b120f320bc366256b8 dotnet8.0-debugsource-8.0.128-1.el10_0.ppc64le.rpm SHA-256: 975b7de96bdf1ad30c0dc830275cecb3c5b8d23f7752346f519f3a295df0621c Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 SRPM dotnet8.0-8.0.128-1.el10_0.src.rpm SHA-256: b58a1d23a241817676ab3d3df62a32277dadea9f2479b49e73bfcaf31e251470 aarch64 aspnetcore-runtime-8.0-8.0.28-1.el10_0.aarch64.rpm SHA-256: c24d846ba6f25fad02e9b3158ae303f4c64df1e14ae05bf8495271d47c5410c1 aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_0.aarch64.rpm SHA-256: cf50253a8fea06289f9145f80