Package
dotnet-bootstrap-9
Component
Microsoft.NETCore.App.Runtime.linux-x64
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2026-69651 is fixed in .NET runtime 9.0.21 (https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.21/9.0.21.md). dotnet-bootstrap-9 9.0.122 ships the bootstrap SDK that the upstream dotnet/dotnet v9.0.122 source tag requires to build .NET from source. That tag's global.json pins SDK 9.0.121, which carries runtime 9.0.20 (/usr/share/dotnet-bootstrap/dotnet/shared/Microsoft.NETCore.App/9.0.20/). Waiting for an upstream dotnet/dotnet 9.0 release whose bootstrap SDK carries the fixed runtime.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-69651 https://github.com/advisories/GHSA-3rxq-g8rj-r2cf https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.21/9.0.21.md https://github.com/dotnet/dotnet/blob/v9.0.122/global.json
Status
Previous location
/usr/share/dotnet-bootstrap/dotnet/shared/Microsoft.NETCore.App/9.0.19/Microsoft.NETCore.App.deps.jsonNew location
/usr/share/dotnet-bootstrap/dotnet/shared/Microsoft.NETCore.App/9.0.20/Microsoft.NETCore.App.deps.jsonImpact
version-only path change detected during APK rebuild
Status