Is there a patch available for CVE-2025-55247?

Yes, a patch is available for CVE-2025-55247. Update the affected software to the latest version immediately.

dotnet8-runtime CVE-2025-55247

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:55 vuln.today

DescriptionCVE.org

Alpine Linux: dotnet8-runtime fixed in 8.0.21-r0

AnalysisAI

dotnet8-runtime on Alpine Linux received a security fix in package version 8.0.21-r0. The underlying vulnerability details are not disclosed in the available advisory data - no description, CVSS score, or CWE has been published at time of analysis. The fix was reported exclusively by the Alpine Linux vendor, suggesting this is an Alpine-specific package update tracking an upstream .NET 8 runtime security issue.

Technical ContextAI

The affected component is the .NET 8 runtime as packaged for Alpine Linux (dotnet8-runtime). Alpine Linux packages .NET as a musl-libc-linked binary distinct from the upstream Microsoft builds, which can introduce Alpine-specific patch lag or packaging-level vulnerabilities separate from upstream CVEs. The .NET 8 runtime encompasses managed code execution, JIT compilation, and the BCL (Base Class Library). Without a CWE or CVSS vector, the root cause class - whether memory safety, input validation, privilege escalation, or other - cannot be determined from available data.

Affected ProductsAI

Alpine Linux dotnet8-runtime versions prior to 8.0.21-r0 are affected. The fixed package version is 8.0.21-r0 as reported by the Alpine Linux vendor. The affected platform is Alpine Linux (musl-libc based). No CPE string was provided in the available data, and no upstream Microsoft .NET advisory or NVD entry with additional version range details was found at time of analysis.

RemediationAI

Upgrade the dotnet8-runtime Alpine package to version 8.0.21-r0 or later using the Alpine package manager: 'apk upgrade dotnet8-runtime'. This is the vendor-released fix per the Alpine Linux advisory. No workarounds or compensating controls are documented in the available data. Since the vulnerability details are undisclosed, specific feature-level mitigations cannot be recommended. Organizations unable to patch immediately should consider restricting network exposure of services running on the .NET 8 runtime until the upgrade can be applied, though this guidance is precautionary given the unknown attack vector.