Ubuntu reissues a Blazor debug proxy fix and patches .NET Brotli flaw
Serguey Asael Shinder1 min readUbuntu published security notice USN-8958-1 on 29 October with updated .NET packages addressing three vulnerabilities, one of which it had already tried to fix earlier in the month.
The first, CVE-2026-102870, is in the .NET Blazor WebAssembly debug proxy, which did not properly escape certain values; the notice says an attacker could possibly use it to execute arbitrary code. Ubuntu states that the fix originally shipped in USN-8942-1 was found to be incomplete. Only dotnet10 and dotnet11 were affected by this one.
The second, CVE-2026-111497, sits in the Brotli decompressor that .NET bundles: crafted input could crash a service or, according to Ubuntu, possibly lead to code execution from a remote position. The third, CVE-2026-114148, is credited to Alen Cheung and involves how .NET treats the owner of a file in some situations; the result could be a local user gaining higher privileges.
Fixed packages are dotnet8 8.0.33 on Ubuntu 22.04 and 24.04, dotnet10 10.0.14 on 24.04, 26.04 and 26.10, and dotnet11 11.0.0 release candidate 3 on 26.10. Ubuntu says a standard system update applies the changes.
What it means
Two points are worth acting on. Anyone who updated after USN-8942-1 and considered the Blazor debug proxy issue closed should update again. And the Brotli flaw sits in a decompression path that services may expose to untrusted input, which makes it the one to prioritise on servers. The debug proxy is a development component, so its practical exposure depends on whether it is reachable outside a developer's machine; the notice does not give severity scores.