Ubuntu fixes .NET debug-proxy and Brotli flaws
Original title: USN-8958-1: .NET vulnerabilities
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
Ubuntu security notice USN-8958-1 covers .NET issues. The Blazor WebAssembly debug proxy did not properly escape certain values, which an attacker could possibly use to execute arbitrary code (CVE-2026-102870); the earlier fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected. A separate flaw in the Brotli decompression library used by .NET could let a remote attacker cause a denial of service or execute arbitrary code (CVE-2026-111497). The notice also begins describing improper file-ownership handling found by Alen Cheung, but the snippet cuts off.
Unconfirmed: The snippet ends before stating the file-ownership impact, affected versions, or fixed package versions.
- CVE-2026-102870 affects only dotnet10 and dotnet11.
- USN-8942-1 did not fully fix the debug-proxy issue.
- CVE-2026-111497 is in .NET's Brotli decompression of certain streams.
- The file-ownership finding is attributed to Alen Cheung.
Impact: Possible arbitrary code execution or denial of service
| Product | Affected |
|---|---|
| Microsoft .NET | — |
- 1.Apply Ubuntu USN-8958-1 updates for affected .NET packages.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
It was discovered that the . NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.