Alpine: multiple aspnetcore10-runtime packages, multiple dotnet-host packages: security update to 10.0.13-r0

critical Tenable Self-Hosted Container Security Plugin ID 476163

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a
security feature over a network. (CVE-2026-96957)

- Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker
to execute code over a network. (CVE-2026-102870)

- Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a
network. (CVE-2026-105016)

- Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
(CVE-2026-58280)

- Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose
information over a network. (CVE-2026-66822)

Solution

Update the aspnetcore10-runtime library and its related packages to version 10.0.13-r0 or later.

Plugin Details

Severity: Critical

ID: 476163

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/19/2026

Updated: 10/19/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.49

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-96957

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-105016

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2026-102870, CVE-2026-105016, CVE-2026-58280, CVE-2026-66822, CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162, CVE-2026-70165, CVE-2026-70174, CVE-2026-70175, CVE-2026-70179, CVE-2026-70181, CVE-2026-70183, CVE-2026-70186, CVE-2026-70188, CVE-2026-70190, CVE-2026-70196, CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697, CVE-2026-88092, CVE-2026-92707, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230, CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236, CVE-2026-96237, CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

Detections

Analytics