CVE-2026-118748

Publication date 10 November 2026

Last updated 11 November 2026

Ubuntu priority

Why this priority?

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
dotnet6	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
dotnet7	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Ignored see notes
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
dotnet8	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
dotnet10	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
dotnet11	26.10 stonking	Vulnerable
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Notes

iconstantin

.NET 7 is end of life upstream.

mdeslaur

Marking .NET 6 as deferred until information is available to determine if it is impacted.

References

Related Ubuntu Security Notices (USN)

USN-9042-1
.NET vulnerabilities
11 November 2026

Other references

Access our resources on patching vulnerabilities