mcr.microsoft.com/dotnet/sdk:10.0.203

Base OS: ubuntu 24.04100 vulnerabilities fixed

Patched Image

ghcr.io/verity-org/dotnet/sdk:10.0.203

Supply Chain

SignedSLSA L3SBOMRekor

Verify this artifact

Cosign signature

cosign verify \
  --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/verity-org/dotnet/sdk:10.0.203

Build provenance

gh attestation verify \
  oci://ghcr.io/verity-org/dotnet/sdk:10.0.203 \
  --owner verity-org

Before patching

Found 150 vulnerabilities in the original image. 100 fixed by Copa. 50 remaining after patching.

6 HIGH82 MEDIUM62 LOW

Fix available — pending patch

These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.

CVE-2026-42899HIGH
Package
Microsoft.AspNetCore.App.Runtime.linux-x64
Installed
10.0.7
Fixed
8.0.27, 9.0.16, 10.0.8
CVE-2026-45591HIGH
Package
Microsoft.AspNetCore.App.Runtime.linux-x64
Installed
10.0.7
Fixed
8.0.28, 9.0.17, 10.0.9
CVE-2026-26171HIGH
Package
System.Security.Cryptography.Xml
Installed
10.0.5
Fixed
10.0.6, 9.0.15, 8.0.3
CVE-2026-33116HIGH
Package
System.Security.Cryptography.Xml
Installed
10.0.5
Fixed
10.0.6, 9.0.15, 8.0.3
CVE-2026-45491MEDIUM
Package
Microsoft.NETCore.App.Runtime.linux-x64
Installed
10.0.7
Fixed
8.0.28, 9.0.17, 10.0.9
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Packaging
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Protocol
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Packaging
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Protocol
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Packaging
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Protocol
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Packaging
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Protocol
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Packaging
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Protocol
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Packaging
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1
GHSA-g4vj-cjjj-v7hgLOW
Package
NuGet.Protocol
Installed
7.3.1-rc.22005
Fixed
4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1

ID	Package	Installed	Fixed	Severity
CVE-2026-42899	Microsoft.AspNetCore.App.Runtime.linux-x64	10.0.7	8.0.27, 9.0.16, 10.0.8	HIGH
CVE-2026-45591	Microsoft.AspNetCore.App.Runtime.linux-x64	10.0.7	8.0.28, 9.0.17, 10.0.9	HIGH
CVE-2026-26171	System.Security.Cryptography.Xml	10.0.5	10.0.6, 9.0.15, 8.0.3	HIGH
CVE-2026-33116	System.Security.Cryptography.Xml	10.0.5	10.0.6, 9.0.15, 8.0.3	HIGH
CVE-2026-45491	Microsoft.NETCore.App.Runtime.linux-x64	10.0.7	8.0.28, 9.0.17, 10.0.9	MEDIUM
GHSA-g4vj-cjjj-v7hg	NuGet.Packaging	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Protocol	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Packaging	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Protocol	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Packaging	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Protocol	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Packaging	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Protocol	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Packaging	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Protocol	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Packaging	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW
GHSA-g4vj-cjjj-v7hg	NuGet.Protocol	7.3.1-rc.22005	4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1	LOW

Awaiting upstream fix

No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.

CVE-2026-27456MEDIUM
Package
bsdutils
Installed
1:2.39.3-9ubuntu6.5
Fixed
CVE-2024-52005MEDIUM
Package
git
Installed
1:2.43.0-1ubuntu7.3
Fixed
CVE-2024-52005MEDIUM
Package
git-man
Installed
1:2.43.0-1ubuntu7.3
Fixed
CVE-2026-27456MEDIUM
Package
libblkid1
Installed
2.39.3-9ubuntu6.5
Fixed
CVE-2026-4046MEDIUM
Package
libc-bin
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-4437MEDIUM
Package
libc-bin
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-4438MEDIUM
Package
libc-bin
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-5435MEDIUM
Package
libc-bin
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-6238MEDIUM
Package
libc-bin
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-4046MEDIUM
Package
libc6
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-4437MEDIUM
Package
libc6
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-4438MEDIUM
Package
libc6
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-5435MEDIUM
Package
libc6
Installed
2.39-0ubuntu8.7
Fixed
CVE-2026-6238MEDIUM
Package
libc6
Installed
2.39-0ubuntu8.7
Fixed
CVE-2025-66382MEDIUM
Package
libexpat1
Installed
2.6.1-2ubuntu0.4
Fixed
CVE-2026-27456MEDIUM
Package
libmount1
Installed
2.39.3-9ubuntu6.5
Fixed
CVE-2026-13757MEDIUM
Package
libp11-kit0
Installed
0.25.3-4ubuntu2.1
Fixed
CVE-2026-27456MEDIUM
Package
libsmartcols1
Installed
2.39.3-9ubuntu6.5
Fixed
CVE-2026-27456MEDIUM
Package
libuuid1
Installed
2.39.3-9ubuntu6.5
Fixed
CVE-2026-27456MEDIUM
Package
mount
Installed
2.39.3-9ubuntu6.5
Fixed
CVE-2026-27456MEDIUM
Package
util-linux
Installed
2.39.3-9ubuntu6.5
Fixed
CVE-2021-31879MEDIUM
Package
wget
Installed
1.21.4-1ubuntu4.1
Fixed
CVE-2026-58469MEDIUM
Package
wget
Installed
1.21.4-1ubuntu4.1
Fixed
CVE-2026-58470MEDIUM
Package
wget
Installed
1.21.4-1ubuntu4.1
Fixed
CVE-2026-58471MEDIUM
Package
wget
Installed
1.21.4-1ubuntu4.1
Fixed
CVE-2026-58472MEDIUM
Package
wget
Installed
1.21.4-1ubuntu4.1
Fixed
CVE-2024-2236LOW
Package
libgcrypt20
Installed
1.10.3-2ubuntu0.1
Fixed
CVE-2025-5222LOW
Package
libicu74
Installed
74.2-1ubuntu3.1
Fixed
CVE-2026-40228LOW
Package
libsystemd0
Installed
255.4-1ubuntu8.16
Fixed
CVE-2026-40228LOW
Package
libudev1
Installed
255.4-1ubuntu8.16
Fixed
CVE-2024-56433LOW
Package
login
Installed
1:4.13+dfsg1-4ubuntu3.2
Fixed
CVE-2024-56433LOW
Package
passwd
Installed
1:4.13+dfsg1-4ubuntu3.2
Fixed
CVE-2026-27171LOW
Package
zlib1g
Installed
1:1.3.dfsg-3.1ubuntu2.1
Fixed

ID	Package	Installed	Severity
CVE-2026-27456	bsdutils	1:2.39.3-9ubuntu6.5	MEDIUM
CVE-2024-52005	git	1:2.43.0-1ubuntu7.3	MEDIUM
CVE-2024-52005	git-man	1:2.43.0-1ubuntu7.3	MEDIUM
CVE-2026-27456	libblkid1	2.39.3-9ubuntu6.5	MEDIUM
CVE-2026-4046	libc-bin	2.39-0ubuntu8.7	MEDIUM
CVE-2026-4437	libc-bin	2.39-0ubuntu8.7	MEDIUM
CVE-2026-4438	libc-bin	2.39-0ubuntu8.7	MEDIUM
CVE-2026-5435	libc-bin	2.39-0ubuntu8.7	MEDIUM
CVE-2026-6238	libc-bin	2.39-0ubuntu8.7	MEDIUM
CVE-2026-4046	libc6	2.39-0ubuntu8.7	MEDIUM
CVE-2026-4437	libc6	2.39-0ubuntu8.7	MEDIUM
CVE-2026-4438	libc6	2.39-0ubuntu8.7	MEDIUM
CVE-2026-5435	libc6	2.39-0ubuntu8.7	MEDIUM
CVE-2026-6238	libc6	2.39-0ubuntu8.7	MEDIUM
CVE-2025-66382	libexpat1	2.6.1-2ubuntu0.4	MEDIUM
CVE-2026-27456	libmount1	2.39.3-9ubuntu6.5	MEDIUM
CVE-2026-13757	libp11-kit0	0.25.3-4ubuntu2.1	MEDIUM
CVE-2026-27456	libsmartcols1	2.39.3-9ubuntu6.5	MEDIUM
CVE-2026-27456	libuuid1	2.39.3-9ubuntu6.5	MEDIUM
CVE-2026-27456	mount	2.39.3-9ubuntu6.5	MEDIUM
CVE-2026-27456	util-linux	2.39.3-9ubuntu6.5	MEDIUM
CVE-2021-31879	wget	1.21.4-1ubuntu4.1	MEDIUM
CVE-2026-58469	wget	1.21.4-1ubuntu4.1	MEDIUM
CVE-2026-58470	wget	1.21.4-1ubuntu4.1	MEDIUM
CVE-2026-58471	wget	1.21.4-1ubuntu4.1	MEDIUM
CVE-2026-58472	wget	1.21.4-1ubuntu4.1	MEDIUM
CVE-2024-2236	libgcrypt20	1.10.3-2ubuntu0.1	LOW
CVE-2025-5222	libicu74	74.2-1ubuntu3.1	LOW
CVE-2026-40228	libsystemd0	255.4-1ubuntu8.16	LOW
CVE-2026-40228	libudev1	255.4-1ubuntu8.16	LOW
CVE-2024-56433	login	1:4.13+dfsg1-4ubuntu3.2	LOW
CVE-2024-56433	passwd	1:4.13+dfsg1-4ubuntu3.2	LOW
CVE-2026-27171	zlib1g	1:1.3.dfsg-3.1ubuntu2.1	LOW

Original image reference

mcr.microsoft.com/dotnet/sdk:10.0.203