USN-8958-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8958-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8958-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8958-1
Upstream
CVE (3)
Related
UBUNTU (3)
Published
2026-10-29T17:02:55Z
Modified
2026-10-30T03:13:10Z
Summary
dotnet8, dotnet10, dotnet11 vulnerabilities
Details

It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected dotnet10 and dotnet11. (CVE-2026-102870)

It was discovered that the Brotli decompression library used by .NET incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-111497)

Alen Cheung discovered that .NET did not properly handle file ownership in certain circumstances. An attacker could possibly use this issue to elevate local privileges. (CVE-2026-114148)

References

Affected packages

Ubuntu:22.04:LTS
dotnet8

Package

Name
dotnet8
Purl
pkg:deb/ubuntu/dotnet8?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.133-8.0.33-0ubuntu1~22.04.1

Affected versions

8.*
8.0.102-8.0.2-0ubuntu1~22.04.1
8.0.103-8.0.3-0ubuntu1~22.04.1
8.0.103-8.0.3-0ubuntu1~22.04.2
8.0.105-8.0.5-0ubuntu1~22.04.1
8.0.107-8.0.7-0ubuntu1~22.04.1
8.0.108-8.0.8-0ubuntu1~22.04.1
8.0.110-8.0.10-0ubuntu1~22.04.1
8.0.111-8.0.11-0ubuntu1~22.04.1
8.0.112-8.0.12-0ubuntu1~22.04.1
8.0.114-8.0.14-0ubuntu1~22.04.1
8.0.115-8.0.15-0ubuntu1~22.04.1
8.0.116-8.0.16-0ubuntu1~22.04.1
8.0.117-8.0.17-0ubuntu1~22.04.1
8.0.118-8.0.18-0ubuntu1~22.04.1
8.0.119-8.0.19-0ubuntu1~22.04.1
8.0.120-8.0.20-0ubuntu1~22.04.1
8.0.121-8.0.21-0ubuntu1~22.04.1
8.0.122-8.0.22-0ubuntu1~22.04.1
8.0.123-8.0.23-0ubuntu1~22.04.1
8.0.124-8.0.24-0ubuntu1~22.04.1
8.0.125-8.0.25-0ubuntu1~22.04.1
8.0.126-8.0.26-0ubuntu1~22.04.1
8.0.127-8.0.27-0ubuntu1~22.04.1
8.0.128-8.0.28-0ubuntu1~22.04.1
8.0.129-8.0.29-0ubuntu1~22.04.1
8.0.130-8.0.30-0ubuntu1~22.04.1
8.0.131-8.0.31-0ubuntu1~22.04.1
8.0.132-8.0.32-0ubuntu1~22.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-host-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0",
            "binary_version":  "8.0.133-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0-source-built-artifacts",
            "binary_version":  "8.0.133-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-8.0",
            "binary_version":  "8.0.133-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-8.0",
            "binary_version":  "8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-templates-8.0",
            "binary_version":  "8.0.133-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet8",
            "binary_version":  "8.0.133-8.0.33-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "netstandard-targeting-pack-2.1-8.0",
            "binary_version":  "8.0.133-0ubuntu1~22.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-111497",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "high",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-114148",
            "severity":  [
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8958-1.json"
Ubuntu:24.04:LTS
dotnet10

Package

Name
dotnet10
Purl
pkg:deb/ubuntu/dotnet10?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.0.114-10.0.14-0ubuntu1~24.04.1

Affected versions

10.*
10.0.100-10.0.0-0ubuntu1~24.04.1
10.0.101-10.0.1-0ubuntu1~24.04.2
10.0.103-10.0.3-0ubuntu1~24.04.1
10.0.104-10.0.4-0ubuntu1~24.04.1
10.0.105-10.0.5-0ubuntu1~24.04.1
10.0.106-10.0.6-0ubuntu1~24.04.1
10.0.107-10.0.7-0ubuntu1~24.04.1
10.0.108-10.0.8-0ubuntu1~24.04.1
10.0.109-10.0.9-0ubuntu1~24.04.1
10.0.110-10.0.10-0ubuntu1~24.04.1
10.0.111-10.0.11-0ubuntu1~24.04.1
10.0.112-10.0.12-0ubuntu1~24.04.1
10.0.113-10.0.13-0ubuntu1~24.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-host-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0",
            "binary_version":  "10.0.114-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version":  "10.0.114-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-10.0",
            "binary_version":  "10.0.114-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-10.0",
            "binary_version":  "10.0.114-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-templates-10.0",
            "binary_version":  "10.0.114-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet10",
            "binary_version":  "10.0.114-10.0.14-0ubuntu1~24.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-102870",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-111497",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "high",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-114148",
            "severity":  [
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8958-1.json"
dotnet8

Package

Name
dotnet8
Purl
pkg:deb/ubuntu/dotnet8?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.133-8.0.33-0ubuntu1~24.04.1

Affected versions

8.*
8.0.100-8.0.0~rc1-0ubuntu1
8.0.100-8.0.0~rc2-0ubuntu1
8.0.100-8.0.0~rc2-0ubuntu2
8.0.100-8.0.0-0ubuntu1
8.0.100-8.0.0-0ubuntu2
8.0.101-8.0.1-0ubuntu1
8.0.101-8.0.1-0ubuntu2
8.0.102-8.0.2-0ubuntu1
8.0.103-8.0.3-0ubuntu2
8.0.103-8.0.3-0ubuntu3
8.0.104-8.0.4-0ubuntu1
8.0.105-8.0.5-0ubuntu1~24.04.1
8.0.107-8.0.7-0ubuntu1~24.04.1
8.0.108-8.0.8-0ubuntu1~24.04.1
8.0.108-8.0.8-0ubuntu1~24.04.2
8.0.110-8.0.10-0ubuntu1~24.04.1
8.0.111-8.0.11-0ubuntu1~24.04.1
8.0.112-8.0.12-0ubuntu1~24.04.1
8.0.114-8.0.14-0ubuntu1~24.04.1
8.0.115-8.0.15-0ubuntu1~24.04.1
8.0.116-8.0.16-0ubuntu1~24.04.1
8.0.117-8.0.17-0ubuntu1~24.04.1
8.0.118-8.0.18-0ubuntu1~24.04.1
8.0.119-8.0.19-0ubuntu1~24.04.1
8.0.120-8.0.20-0ubuntu1~24.04.1
8.0.121-8.0.21-0ubuntu1~24.04.1
8.0.122-8.0.22-0ubuntu1~24.04.1
8.0.123-8.0.23-0ubuntu1~24.04.1
8.0.124-8.0.24-0ubuntu1~24.04.1
8.0.125-8.0.25-0ubuntu1~24.04.1
8.0.126-8.0.26-0ubuntu1~24.04.1
8.0.127-8.0.27-0ubuntu1~24.04.1
8.0.128-8.0.28-0ubuntu1~24.04.1
8.0.129-8.0.29-0ubuntu1~24.04.1
8.0.130-8.0.30-0ubuntu1~24.04.1
8.0.131-8.0.31-0ubuntu1~24.04.1
8.0.132-8.0.32-0ubuntu1~24.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-host-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0",
            "binary_version":  "8.0.133-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0-source-built-artifacts",
            "binary_version":  "8.0.133-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-8.0",
            "binary_version":  "8.0.133-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-8.0",
            "binary_version":  "8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-templates-8.0",
            "binary_version":  "8.0.133-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet8",
            "binary_version":  "8.0.133-8.0.33-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "netstandard-targeting-pack-2.1-8.0",
            "binary_version":  "8.0.133-0ubuntu1~24.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-102870",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-111497",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "high",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-114148",
            "severity":  [
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8958-1.json"
Ubuntu:26.04:LTS
dotnet10

Package

Name
dotnet10
Purl
pkg:deb/ubuntu/dotnet10?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.0.114-10.0.14-0ubuntu1~26.04.1

Affected versions

10.*
10.0.100-10.0.0~rc1-0ubuntu1
10.0.100-10.0.0~rc2-0ubuntu1
10.0.100-10.0.0-0ubuntu1
10.0.100-10.0.0-0ubuntu2
10.0.101-10.0.1-0ubuntu1
10.0.101-10.0.1-0ubuntu2
10.0.101-10.0.1-0ubuntu3
10.0.102-10.0.2-0ubuntu1
10.0.103-10.0.3-0ubuntu1
10.0.104-10.0.4-0ubuntu1
10.0.105-10.0.5-0ubuntu1
10.0.107-10.0.7-0ubuntu1~26.04.1
10.0.108-10.0.8-0ubuntu1~26.04.1
10.0.109-10.0.9-0ubuntu1~26.04.1
10.0.110-10.0.10-0ubuntu1~26.04.1
10.0.111-10.0.11-0ubuntu1~26.04.1
10.0.112-10.0.12-0ubuntu1~26.04.1
10.0.113-10.0.13-0ubuntu1~26.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-host-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version":  "10.0.114-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-templates-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet10",
            "binary_version":  "10.0.114-10.0.14-0ubuntu1~26.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-102870",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-111497",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "high",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-114148",
            "severity":  [
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:26.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8958-1.json"
Ubuntu:26.10
dotnet10

Package

Name
dotnet10
Purl
pkg:deb/ubuntu/dotnet10?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.0.114-10.0.14-0ubuntu1~26.10.1

Affected versions

10.*
10.0.105-10.0.5-0ubuntu1
10.0.107-10.0.7-0ubuntu1~26.04.1
10.0.108-10.0.8-0ubuntu1
10.0.109-10.0.9-0ubuntu1
10.0.110-10.0.10-0ubuntu3
10.0.111-10.0.11-0ubuntu1
10.0.112-10.0.12-0ubuntu1
10.0.112-10.0.12-0ubuntu2
10.0.113-10.0.13-0ubuntu1~26.10.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-host-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version":  "10.0.114-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-10.0",
            "binary_version":  "10.0.14-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-templates-10.0",
            "binary_version":  "10.0.114-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet10",
            "binary_version":  "10.0.114-10.0.14-0ubuntu1~26.10.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-102870",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-111497",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "high",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-114148",
            "severity":  [
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8958-1.json"
dotnet11

Package

Name
dotnet11
Purl
pkg:deb/ubuntu/dotnet11?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.0.100-11.0.0~rc3-0ubuntu1~26.10.1

Affected versions

11.*
11.0.100-11.0.0~rc1-0ubuntu1
11.0.100-11.0.0~rc2-0ubuntu1~26.10.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-host-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-11.0",
            "binary_version":  "11.0.100~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-11.0-source-built-artifacts",
            "binary_version":  "11.0.100~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-11.0",
            "binary_version":  "11.0.100~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-11.0",
            "binary_version":  "11.0.100~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-11.0",
            "binary_version":  "11.0.0~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-templates-11.0",
            "binary_version":  "11.0.100~rc3-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet11",
            "binary_version":  "11.0.100-11.0.0~rc3-0ubuntu1~26.10.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-102870",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-111497",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "high",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-114148",
            "severity":  [
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8958-1.json"