RHBA-2025:4932MediumCVSS 5.9

Red Hat Bug Fix Advisory: dotnet8.0 bug fix and enhancement update

Published
May 13, 2025
Last Modified
October 9, 2026

🔗 CVE IDs covered (1)

CVE-2024-37890 →

📋 Description

CVE-2024-37890 — nodejs-ws: denial of service when handling a request with many HTTP headers

🎯 Affected products91

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • aspnetcore-runtime-8.0-0:8.0.13-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-runtime-8.0-0:8.0.13-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-runtime-8.0-0:8.0.13-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-runtime-8.0-0:8.0.13-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-runtime-dbg-8.0-0:8.0.13-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-runtime-dbg-8.0-0:8.0.13-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-runtime-dbg-8.0-0:8.0.13-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-runtime-dbg-8.0-0:8.0.13-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-targeting-pack-8.0-0:8.0.13-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-targeting-pack-8.0-0:8.0.13-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-targeting-pack-8.0-0:8.0.13-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • aspnetcore-targeting-pack-8.0-0:8.0.13-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-0:8.0.13-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-0:8.0.13-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-0:8.0.13-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-0:8.0.13-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-apphost-pack-8.0-debuginfo-0:8.0.13-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • dotnet-hostfxr-8.0-0:8.0.13-2.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-hostfxr-8.0-0:8.0.13-2.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-hostfxr-8.0-0:8.0.13-2.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dotnet-hostfxr-8.0-0:8.0.13-2.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +61 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. The issue can be mitigated also by seting server.maxHeadersCount to 0.

🔗 References (4)