Azure / Azure/azure-powershell
[Feature]: Base image mcr.microsoft.com/azure-powershell:ubuntu-24.04 ships vulnerable .NET runtime (CVE-2026-42899)
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description of the new feature
## Summary
The `mcr.microsoft.com/azure-powershell:ubuntu-24.04` base image bundles a .NET runtime version affected by **CVE-2026-42899** (CVSS 7.5 HIGH). A new image with .NET ≥ 9.0.16 is needed to remediate the vulnerability.
## CVE Details
| Field | Value |
|---|---|
| CVE ID | [CVE-2026-42899](https://nvd.nist.gov/vuln/detail/CVE-2026-42899) |
| Severity | **7.5 HIGH** (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| Weakness | CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop) |
| Description | ASP.NET Core allows an unauthenticated remote attacker to deny service over a network |
| Affected versions | .NET 9.x < 9.0.16 |
| Fixed in | .NET 9.0.16 |
| Microsoft Advisory | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899 |
## Affected Image
### Proposed implementation details (optional)
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.