Все бюллетени/sisyphus/ALT-PU-2026-18564-3
ALT-PU-2026-18564-3

Обновление пакета dotnet-bootstrap-10.0 в ветке sisyphus

Версия10.0.402-alt1
Задание#437045
Опубликовано2026-10-16
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (83)

BDU:2026-16531
MEDIUM5.3

Уязвимость библиотеки сериализации MessagePack, связанная с ненадлежащим управлением последовательным распределением памяти, позволяющая нарушителю вызывать отказ в обслуживании

Опубликовано: 2026-10-13
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
Ссылки
CVE-2026-70162
MEDIUM5.9

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-70183
HIGH7.5

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Опубликовано: 2026-10-13Изменено: 2026-10-14
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-70188
CRITICAL9.1

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

Опубликовано: 2026-10-13Изменено: 2026-10-14
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Ссылки
CVE-2026-88092
CRITICAL9.4

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Опубликовано: 2026-10-13Изменено: 2026-10-14
CVSS 3.xКРИТИЧЕСКАЯ 9.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Ссылки
CVE-2026-92707
MEDIUM5.3

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

Опубликовано: 2026-10-15Изменено: 2026-10-15
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ссылки
CVE-2026-96230
HIGH8.8

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ссылки
GHSA-3rxq-g8rj-r2cf
HIGH7.5

Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
GHSA-494h-xx7x-5frh
HIGH7.5

Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
GHSA-4j9v-h7pp-725h
HIGH8.8

Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ссылки
GHSA-c399-9853-6jmj
HIGH7.5

Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
GHSA-f4g7-52wc-p8x7
HIGH7.5

Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
GHSA-f63g-mx39-3r38
HIGH8.8

Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ссылки
GHSA-fpq8-4vhr-rcxx
CRITICAL9.1

Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Ссылки
GHSA-mc4q-93x5-f6hj
HIGH7.5

Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
GHSA-qhrr-8q5h-9q3h
MEDIUM5.3

MessagePack: Nested arrays can blow past buffer length limits

Опубликовано: 2026-10-15
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ссылки
GHSA-w5qq-qrpp-rf4c
HIGH7.5

Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
GHSA-w6wh-p4g7-mpj2
HIGH7.8

Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
GHSA-wxxw-5cvc-53j7
MEDIUM5.9

Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability

Опубликовано: 2026-10-13Изменено: 2026-10-13
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки