Red Hat Hardened Images .NET 9 Update Fixes Four Network Flaws

Quick Answer

Red Hat published RHSA-2026:84424 for four .NET 9 and ASP.NET Core flaws in Hardened Images, including three High remote denial-of-service issues and one Medium information disclosure. Match image contents to the advisory, rebuild or redeploy with the complete 9.0.21 runtime and 9.0.122 SDK package set, test services, monitor stability, and retain evidence.

Last verified: 2026-10-18 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	Red Hat Hardened Images .NET 9 runtime, ASP.NET Core, SDK, targeting, template, and related RPM families
Advisory	RHSA-2026:84424
CVEs	CVE-2026-58280, CVE-2026-66822, CVE-2026-69651, CVE-2026-70159
Authoritative release date	2026-10-17 18:47:31 UTC
Authority revision date	2026-10-17 20:48:10 UTC
Affected versions	Red Hat Hardened Images matched to RHSA-2026:84424 that do not contain its complete fixed .NET 9 package set; the CSAF lists fixed RPMs rather than a general affected-version range.
Fixed version	the complete RHSA-2026:84424 package set for the deployed architecture, including .NET and ASP.NET Core runtime 9.0.21 and SDK 9.0.122 RPMs
CVSS base score	5.9 / 7.5 (CVSS v3.1)
CVSS severity	Medium / High
Exploitation status	Not stated by Red Hat; no exploitation claim is inferred.

What Changed

Red Hat fixed three remotely reachable denial-of-service flaws and one information-disclosure flaw in the .NET 9 and ASP.NET Core packages used by Hardened Images. The CSAF does not state that exploitation has occurred and marks no restart as required.

What To Validate Now

1. Inventory. Locate Red Hat Hardened Images and derived workloads containing .NET 9 or ASP.NET Core, then record image digests, build provenance, architecture, installed RPMs, network exposure, service owner, and recovery dependencies.
2. Establish applicability. Compare each deployment with the authority's affected-version statement: Red Hat Hardened Images matched to RHSA-2026:84424 that do not contain its complete fixed .NET 9 package set; the CSAF lists fixed RPMs rather than a general affected-version range. Do not infer applicability from product family or severity alone.
3. Remediate. Use the supported Red Hat Hardened Images channel to consume the complete RHSA-2026:84424 architecture-specific package set, including .NET and ASP.NET Core runtime 9.0.21 and SDK 9.0.122 RPMs, then rebuild and redeploy derived images.
4. Validate. Confirm all advisory-listed package versions and the deployed image digest, test representative .NET and ASP.NET Core endpoints under normal and bounded-load conditions, review service and platform logs, and verify rollback readiness.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Treat the advisory package set as a unit; partial runtime, SDK, targeting-pack, or template updates can leave inconsistent image contents. Coordinate workload redeployment and compatibility testing, and do not infer compromise from severity alone.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• RHSA-2026:84424

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.