Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-13T17:00:00 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-201

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

A moderate information disclosure vulnerability was found in the .NET runtime. When a .NET application using SocketsHttpHandler sends a request through a proxy that authenticates with basic credentials and the response is an HTTP redirect, the Proxy-Authorization header can be incorrectly retained and forwarded with the redirected request, leaking the basic proxy credentials to the destination server. This allows an unauthorized remote attacker to disclose sensitive proxy authentication information over a network. Red Hat rates this flaw Moderate severity with a CVSS 3.1 base score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), consistent with the upstream assessment. All currently tracked Red Hat product streams shipping the affected dotnet8.0, dotnet9.0, and dotnet10.0 components, including Red Hat Enterprise Linux and Red Hat Hardened Images, are affected, and fixes are being pursued through the respective product channels. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 2026-10-20T00:00:00Z RHSA-2026:86168 dotnet8.0-0:8.0.132-1.el10_2 Red Hat Enterprise Linux 10 2026-10-20T00:00:00Z RHSA-2026:86172 dotnet9.0-0:9.0.122-1.el10_2 Red Hat Enterprise Linux 10 2026-10-20T00:00:00Z RHSA-2026:86195 dotnet10.0-0:10.0.113-1.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-10-22T00:00:00Z RHSA-2026:88424 dotnet9.0-0:9.0.122-1.el10_0 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-10-22T00:00:00Z RHSA-2026:88474 dotnet8.0-0:8.0.132-1.el10_0 Red Hat Enterprise Linux 8 2026-10-20T00:00:00Z RHSA-2026:86170 dotnet9.0-0:9.0.122-1.el8_10 Red Hat Enterprise Linux 8 2026-10-20T00:00:00Z RHSA-2026:86192 dotnet10.0-0:10.0.113-1.el8_10 Red Hat Enterprise Linux 8 2026-10-21T00:00:00Z RHSA-2026:86594 dotnet8.0-0:8.0.132-2.el8_10 Red Hat Enterprise Linux 9 2026-10-20T00:00:00Z RHSA-2026:86169 dotnet8.0-0:8.0.132-1.el9_8 Red Hat Enterprise Linux 9 2026-10-20T00:00:00Z RHSA-2026:86171 dotnet9.0-0:9.0.122-1.el9_8 Red Hat Enterprise Linux 9 2026-10-20T00:00:00Z RHSA-2026:86193 dotnet10.0-0:10.0.113-1.el9_8 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-10-22T00:00:00Z RHSA-2026:88425 dotnet8.0-0:8.0.132-1.el9_4 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-10-22T00:00:00Z RHSA-2026:88422 dotnet8.0-0:8.0.132-1.el9_6 Red Hat Hardened Images 2026-10-17T00:00:00Z RHSA-2026:84424 dotnet9-0-main-9.0.122-0.1.hum1 Red Hat Hardened Images 2026-10-17T00:00:00Z RHSA-2026:84424 dotnet9-0-main-9.0.21-0.1.hum1 Red Hat Hardened Images 2026-10-18T00:00:00Z RHSA-2026:84491 dotnet10-0-main-10.0.113-1.hum1 Red Hat Hardened Images 2026-10-19T00:00:00Z RHSA-2026:84693 dotnet8-0-main-8.0.132-0.1.hum1 https://www.cve.org/CVERecord?id=CVE-2026-66822 https://nvd.nist.gov/vuln/detail/CVE-2026-66822