USN-8740-1
- Source
- https://ubuntu.com/security/notices/USN-8740-1
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8740-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-8740-1
- Upstream
- Related
- Published
- 2026-09-10T06:57:42Z
- Modified
- 2026-09-10T16:42:31Z
- Summary
- dotnet8, dotnet10 vulnerabilities
- Details
-
Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-58649)
Rajesh Chada discovered that the .NET watch AspireServerService improperly exposed information through the use of certain arguments. An attacker could possibly use this issue to elevate privileges and execute arbitrary code. (CVE-2026-69806)
- References
Affected packages
Ubuntu:22.04:LTS / dotnet8
Package
- Name
- dotnet8
- Purl
- pkg:deb/ubuntu/dotnet8?arch=source&distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed8.0.131-8.0.31-0ubuntu1~22.04.1
Affected versions
8.*
8.0.102-8.0.2-0ubuntu1~22.04.1
8.0.103-8.0.3-0ubuntu1~22.04.1
8.0.103-8.0.3-0ubuntu1~22.04.2
8.0.105-8.0.5-0ubuntu1~22.04.1
8.0.107-8.0.7-0ubuntu1~22.04.1
8.0.108-8.0.8-0ubuntu1~22.04.1
8.0.110-8.0.10-0ubuntu1~22.04.1
8.0.111-8.0.11-0ubuntu1~22.04.1
8.0.112-8.0.12-0ubuntu1~22.04.1
8.0.114-8.0.14-0ubuntu1~22.04.1
8.0.115-8.0.15-0ubuntu1~22.04.1
8.0.116-8.0.16-0ubuntu1~22.04.1
8.0.117-8.0.17-0ubuntu1~22.04.1
8.0.118-8.0.18-0ubuntu1~22.04.1
8.0.119-8.0.19-0ubuntu1~22.04.1
8.0.120-8.0.20-0ubuntu1~22.04.1
8.0.121-8.0.21-0ubuntu1~22.04.1
8.0.122-8.0.22-0ubuntu1~22.04.1
8.0.123-8.0.23-0ubuntu1~22.04.1
8.0.124-8.0.24-0ubuntu1~22.04.1
8.0.125-8.0.25-0ubuntu1~22.04.1
8.0.126-8.0.26-0ubuntu1~22.04.1
8.0.127-8.0.27-0ubuntu1~22.04.1
8.0.128-8.0.28-0ubuntu1~22.04.1
8.0.129-8.0.29-0ubuntu1~22.04.1
8.0.130-8.0.30-0ubuntu1~22.04.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "aspnetcore-runtime-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "aspnetcore-runtime-dbg-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "aspnetcore-targeting-pack-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-apphost-pack-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-host-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-hostfxr-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-runtime-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-runtime-dbg-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-sdk-8.0",
"binary_version": "8.0.131-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-sdk-8.0-source-built-artifacts",
"binary_version": "8.0.131-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-sdk-dbg-8.0",
"binary_version": "8.0.131-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-targeting-pack-8.0",
"binary_version": "8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet-templates-8.0",
"binary_version": "8.0.131-0ubuntu1~22.04.1"
},
{
"binary_name": "dotnet8",
"binary_version": "8.0.131-8.0.31-0ubuntu1~22.04.1"
},
{
"binary_name": "netstandard-targeting-pack-2.1-8.0",
"binary_version": "8.0.131-0ubuntu1~22.04.1"
}
]
}
Database specific
cves_map
{
"cves": [
{
"id": "CVE-2026-58649",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
source
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8740-1.json"
Ubuntu:24.04:LTS / dotnet10
Package
- Name
- dotnet10
- Purl
- pkg:deb/ubuntu/dotnet10?arch=source&distro=noble
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed10.0.112-10.0.12-0ubuntu1~24.04.1
Affected versions
10.*
10.0.100-10.0.0-0ubuntu1~24.04.1
10.0.101-10.0.1-0ubuntu1~24.04.2
10.0.103-10.0.3-0ubuntu1~24.04.1
10.0.104-10.0.4-0ubuntu1~24.04.1
10.0.105-10.0.5-0ubuntu1~24.04.1
10.0.106-10.0.6-0ubuntu1~24.04.1
10.0.107-10.0.7-0ubuntu1~24.04.1
10.0.108-10.0.8-0ubuntu1~24.04.1
10.0.109-10.0.9-0ubuntu1~24.04.1
10.0.110-10.0.10-0ubuntu1~24.04.1
10.0.111-10.0.11-0ubuntu1~24.04.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "aspnetcore-runtime-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "aspnetcore-runtime-dbg-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "aspnetcore-targeting-pack-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-apphost-pack-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-host-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-hostfxr-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-runtime-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-runtime-dbg-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-sdk-10.0",
"binary_version": "10.0.112-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-sdk-10.0-source-built-artifacts",
"binary_version": "10.0.112-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-sdk-aot-10.0",
"binary_version": "10.0.112-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-sdk-dbg-10.0",
"binary_version": "10.0.112-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-targeting-pack-10.0",
"binary_version": "10.0.12-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-templates-10.0",
"binary_version": "10.0.112-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet10",
"binary_version": "10.0.112-10.0.12-0ubuntu1~24.04.1"
}
]
}
Database specific
cves_map
{
"cves": [
{
"id": "CVE-2026-58649",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-69806",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:24.04:LTS"
}
source
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8740-1.json"
Ubuntu:24.04:LTS / dotnet8
Package
- Name
- dotnet8
- Purl
- pkg:deb/ubuntu/dotnet8?arch=source&distro=noble
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed8.0.131-8.0.31-0ubuntu1~24.04.1
Affected versions
8.*
8.0.100-8.0.0~rc1-0ubuntu1
8.0.100-8.0.0~rc2-0ubuntu1
8.0.100-8.0.0~rc2-0ubuntu2
8.0.100-8.0.0-0ubuntu1
8.0.100-8.0.0-0ubuntu2
8.0.101-8.0.1-0ubuntu1
8.0.101-8.0.1-0ubuntu2
8.0.102-8.0.2-0ubuntu1
8.0.103-8.0.3-0ubuntu2
8.0.103-8.0.3-0ubuntu3
8.0.104-8.0.4-0ubuntu1
8.0.105-8.0.5-0ubuntu1~24.04.1
8.0.107-8.0.7-0ubuntu1~24.04.1
8.0.108-8.0.8-0ubuntu1~24.04.1
8.0.108-8.0.8-0ubuntu1~24.04.2
8.0.110-8.0.10-0ubuntu1~24.04.1
8.0.111-8.0.11-0ubuntu1~24.04.1
8.0.112-8.0.12-0ubuntu1~24.04.1
8.0.114-8.0.14-0ubuntu1~24.04.1
8.0.115-8.0.15-0ubuntu1~24.04.1
8.0.116-8.0.16-0ubuntu1~24.04.1
8.0.117-8.0.17-0ubuntu1~24.04.1
8.0.118-8.0.18-0ubuntu1~24.04.1
8.0.119-8.0.19-0ubuntu1~24.04.1
8.0.120-8.0.20-0ubuntu1~24.04.1
8.0.121-8.0.21-0ubuntu1~24.04.1
8.0.122-8.0.22-0ubuntu1~24.04.1
8.0.123-8.0.23-0ubuntu1~24.04.1
8.0.124-8.0.24-0ubuntu1~24.04.1
8.0.125-8.0.25-0ubuntu1~24.04.1
8.0.126-8.0.26-0ubuntu1~24.04.1
8.0.127-8.0.27-0ubuntu1~24.04.1
8.0.128-8.0.28-0ubuntu1~24.04.1
8.0.129-8.0.29-0ubuntu1~24.04.1
8.0.130-8.0.30-0ubuntu1~24.04.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "aspnetcore-runtime-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "aspnetcore-runtime-dbg-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "aspnetcore-targeting-pack-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-apphost-pack-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-host-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-hostfxr-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-runtime-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-runtime-dbg-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-sdk-8.0",
"binary_version": "8.0.131-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-sdk-8.0-source-built-artifacts",
"binary_version": "8.0.131-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-sdk-dbg-8.0",
"binary_version": "8.0.131-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-targeting-pack-8.0",
"binary_version": "8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet-templates-8.0",
"binary_version": "8.0.131-0ubuntu1~24.04.1"
},
{
"binary_name": "dotnet8",
"binary_version": "8.0.131-8.0.31-0ubuntu1~24.04.1"
},
{
"binary_name": "netstandard-targeting-pack-2.1-8.0",
"binary_version": "8.0.131-0ubuntu1~24.04.1"
}
]
}
Database specific
cves_map
{
"cves": [
{
"id": "CVE-2026-58649",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-69806",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:24.04:LTS"
}
source
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8740-1.json"
Ubuntu:26.04:LTS / dotnet10
Package
- Name
- dotnet10
- Purl
- pkg:deb/ubuntu/dotnet10?arch=source&distro=resolute
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed10.0.112-10.0.12-0ubuntu1~26.04.1
Affected versions
10.*
10.0.100-10.0.0~rc1-0ubuntu1
10.0.100-10.0.0~rc2-0ubuntu1
10.0.100-10.0.0-0ubuntu1
10.0.100-10.0.0-0ubuntu2
10.0.101-10.0.1-0ubuntu1
10.0.101-10.0.1-0ubuntu2
10.0.101-10.0.1-0ubuntu3
10.0.102-10.0.2-0ubuntu1
10.0.103-10.0.3-0ubuntu1
10.0.104-10.0.4-0ubuntu1
10.0.105-10.0.5-0ubuntu1
10.0.107-10.0.7-0ubuntu1~26.04.1
10.0.108-10.0.8-0ubuntu1~26.04.1
10.0.109-10.0.9-0ubuntu1~26.04.1
10.0.110-10.0.10-0ubuntu1~26.04.1
10.0.111-10.0.11-0ubuntu1~26.04.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "aspnetcore-runtime-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "aspnetcore-runtime-dbg-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "aspnetcore-targeting-pack-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-apphost-pack-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-host-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-hostfxr-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-runtime-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-runtime-dbg-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-sdk-10.0",
"binary_version": "10.0.112-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-sdk-10.0-source-built-artifacts",
"binary_version": "10.0.112-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-sdk-aot-10.0",
"binary_version": "10.0.112-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-sdk-dbg-10.0",
"binary_version": "10.0.112-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-targeting-pack-10.0",
"binary_version": "10.0.12-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet-templates-10.0",
"binary_version": "10.0.112-0ubuntu1~26.04.1"
},
{
"binary_name": "dotnet10",
"binary_version": "10.0.112-10.0.12-0ubuntu1~26.04.1"
}
]
}
Database specific
cves_map
{
"cves": [
{
"id": "CVE-2026-58649",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-69806",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:26.04:LTS"
}
source
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8740-1.json"