CVE-2026-50659

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity.

A moderate severity vulnerability was found in .NET as shipped in Red Hat Enterprise Linux 8, 9, and 10 through the dotnet8.0, dotnet9.0, and dotnet10.0 components. .NET improperly encodes or escapes output, which allows an authenticated attacker with low privileges to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity. The vulnerability affects integrity only and has no impact on confidentiality or availability (Red Hat CVSS 3.1 score 6.5, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), which matches the upstream severity assessment. The flaw affects the .NET 8.0, 9.0, and 10.0 release lines; streams shipping .NET outside these lines, such as the RHEL BR dotnet6.0 stream, and the OpenShift Dev Spaces UDI container image are marked not affected. This issue is handled as delegated: a fix is being pursued through the upstream .NET updates, and several affected Red Hat streams have already shipped the corrected packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.