Azure / Azure/azure-powershell

[Feature]: Base image mcr.microsoft.com/azure-powershell:ubuntu-24.04 ships vulnerable .NET runtime (CVE-2026-42899)

Open
#29,633 1 comment 1 reaction 0 assignees View on GitHub
customer-reported feature-request Security-Issue
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description of the new feature

## Summary

The `mcr.microsoft.com/azure-powershell:ubuntu-24.04` base image bundles a .NET runtime version affected by **CVE-2026-42899** (CVSS 7.5 HIGH). A new image with .NET ≥ 9.0.16 is needed to remediate the vulnerability.

## CVE Details

| Field | Value |
|---|---|
| CVE ID | [CVE-2026-42899](https://nvd.nist.gov/vuln/detail/CVE-2026-42899) |
| Severity | **7.5 HIGH** (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| Weakness | CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop) |
| Description | ASP.NET Core allows an unauthenticated remote attacker to deny service over a network |
| Affected versions | .NET 9.x < 9.0.16 |
| Fixed in | .NET 9.0.16 |
| Microsoft Advisory | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899 |

## Affected Image

### Proposed implementation details (optional)

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.