Alpine: multiple aspnetcore9-runtime packages, multiple dotnet-host packages: security update to 9.0.16-r0

medium Tenable Cloud Security Plugin ID 441846

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker
who successfully exploited this vulnerability could write arbitrary files and directories to certain
locations on a vulnerable system. However, an attacker would have limited control over the destination of
the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to
a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles
files. (CVE-2026-32175)

- Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
(CVE-2026-32177)

- Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
(CVE-2026-35433)

- Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to
deny service over a network. (CVE-2026-42899)

Solution

Update the aspnetcore9-runtime library and its related packages to version 9.0.16-r0 or later.

Plugin Details

Severity: Medium

ID: 441846

Version: Revision 1.8

Type: Local

Family: Alpine Linux Local Security Checks

Published: 5/14/2026

Updated: 6/30/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.49

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-42899

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-32175

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/12/2026

Reference Information

CVE: CVE-2026-32175, CVE-2026-32177, CVE-2026-35433, CVE-2026-42899

Detections

Analytics