All errata/sisyphus/ALT-PU-2026-18838-4
ALT-PU-2026-18838-4

Package update dotnet-sdk-9.0 in branch sisyphus

Version9.0.319-alt1
Task#437239
Published2026-10-20
Max severityCRITICAL
Severity:

Closed issues (81)

BDU:2026-16531
MEDIUM5.3

Уязвимость библиотеки сериализации MessagePack, связанная с ненадлежащим управлением последовательным распределением памяти, позволяющая нарушителю вызывать отказ в обслуживании

Published: 2026-10-13
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2026-16744
CRITICAL9.8

Уязвимость реализации протокола QUIC операционных систем Windows, позволяющая нарушителю выполнить произвольный код

Published: 2026-10-18
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
CVE-2026-70162
MEDIUM5.9

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

Published: 2026-10-13Modified: 2026-10-13
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-92707
MEDIUM5.3

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

Published: 2026-10-15Modified: 2026-10-15
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
GHSA-2fmv-rv2c-59x7
MEDIUM5.9

Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-334f-vvp4-7g6p
HIGH7.5

Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-3rxq-g8rj-r2cf
HIGH7.5

Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-494h-xx7x-5frh
HIGH7.5

Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-4j9v-h7pp-725h
HIGH8.8

Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
GHSA-4mpw-cpwj-hxxj
HIGH8.1

Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-4w5f-7jp2-w48g
HIGH8.8

Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
GHSA-57xr-hfxx-jw5x
MEDIUM5.9

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-5qr9-xxm9-6cmq
MEDIUM6.5

Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
GHSA-7hqp-7c5m-4vq6
HIGH7.5

Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-846f-f764-76mx
HIGH7.5

Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-87vj-4hqv-22p9
HIGH7.5

Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-c27m-942f-rcfh
HIGH8.8

Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
GHSA-c399-9853-6jmj
HIGH7.5

Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-f4g7-52wc-p8x7
HIGH7.5

Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-f749-vhgx-39h6
HIGH8.8

Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
GHSA-fpq8-4vhr-rcxx
CRITICAL9.1

Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
GHSA-fq6x-pvr9-888r
MEDIUM5.3

Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
References
GHSA-g44w-h65v-4cw9
HIGH8.8

Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
GHSA-mc4q-93x5-f6hj
HIGH7.5

Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-mf4x-w4gh-4656
HIGH7.5

Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-pfwj-2f93-rf42
HIGH8.8

Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
GHSA-qhrr-8q5h-9q3h
MEDIUM5.3

MessagePack: Nested arrays can blow past buffer length limits

Published: 2026-10-15
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
GHSA-qjpx-jqm5-h2c4
HIGH8.8

Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
GHSA-r955-8q5j-3h83
HIGH7.5

Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-rv87-ccxw-8ggf
CRITICAL9.4

Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xCRITICAL 9.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
References
GHSA-vrrp-6v32-2p8g
HIGH7.5

Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-w5qq-qrpp-rf4c
HIGH7.5

Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-wxxw-5cvc-53j7
MEDIUM5.9

Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
GHSA-x3vp-85cm-q97r
HIGH8.1

Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-xq57-crx4-g373
HIGH8.8

Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability

Published: 2026-10-13Modified: 2026-10-19
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References