Ubuntu USN-8958-1 fixes three .NET flaws, one exploited

TL;DR: Ubuntu has published USN-8958-1 for .NET, covering three CVEs, one of which is the exploited Brotli flaw CVE-2026-111497. Update the .NET packages on Ubuntu hosts and confirm the version afterwards.

What happened

On October 29, 2026, Ubuntu released USN-8958-1, an advisory for .NET. It bundles three fixes. CVE-2026-102870 is a code injection weakness in the Blazor WebAssembly debug proxy, and Ubuntu says an earlier fix for it, shipped in USN-8942-1, turned out to be incomplete; it only affected the dotnet10 and dotnet11 packages. CVE-2026-111497 is a flaw in the Brotli decompression library that .NET uses, which a remote attacker could use to crash a service or possibly run code. CVE-2026-114148 is a file ownership problem that could let a local attacker gain higher privileges.

The National Vulnerability Database gives CVE-2026-102870 a CVSS v3.1 score of 8.8 from Microsoft, and CVE-2026-114148 a score of 7.8 from Microsoft. The Brotli flaw is the one CISA lists as exploited; our earlier post on CVE-2026-111497 covers its affected versions.

Am I affected?

If you run Ubuntu hosts with .NET installed from Ubuntu's own packages, yes, until you apply the notice. Read USN-8958-1 for the exact package versions per release, and check one machine with:

apt list --installed 2>/dev/null | grep -i dotnet

Ubuntu patches in place, so compare against the version the notice names rather than the upstream .NET number.

How to check with Stackurity

Stackurity assesses installed packages on Ubuntu, so .NET packages from the distribution show up in its inventory and are matched against advisories every hour, using Ubuntu's own version rules so backports are not reported as false alarms. It does not cover .NET installed by script or tarball, so look for those by hand. After you upgrade, a check again records whether the issue is gone. Start a free trial, and see how fixes are tracked.