Alpine Linux CVE-2026-114148

The source states only that dotnet8-runtime is fixed in 8.0.33-r0 and provides no CVSS vector, no CWE, and no description of the triggering mechanism, so concrete prerequisites (required feature, protocol, configuration mode, or privilege level) cannot be extracted from the available data. The exploitation prerequisites and limiting factors are not described in the available sources; consult the upstream Microsoft .NET 8 advisory tied to this Alpine fix. Authentication requirements cannot be confirmed because no CVSS vector is provided.

This entry is an Alpine Linux package-tracking advisory stating only that dotnet8-runtime is fixed in 8.0.33-r0; it carries no CVSS score or vector, no CWE, no EPSS probability, no KEV listing, and no PoC/exploit reference. Because no CVSS vector is supplied, attack vector, complexity, privilege, and scope cannot be assessed, and authentication requirements cannot be confirmed from available data. The vuln.today Decision label is 'this_month', which signals a scheduled-remediation priority rather than act_now or emergency urgency. With EPSS, KEV, and PoC all absent, there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of these signals is not proof of low risk but does not elevate it either. No conflict exists between signals because only one signal (the vendor fix advisory) is present - the dominant limitation here is missing data, not conflicting data. Real-world priority should be driven by the fact that this is a runtime shipped broadly, so the underlying .NET fix likely warrants timely patching, but the specific technical severity of CVE-2026-114148 cannot be substantiated from this input and should be verified against the upstream Microsoft .NET advisory and the Alpine security tracker.

The available source states only that dotnet8-runtime is fixed in 8.0.33-r0 and does not describe how the flaw is triggered, so a concrete attack scenario cannot be constructed from this input. No PoC or exploit reference is present, so no public exploit is identified at time of analysis. Consult the upstream Microsoft .NET 8 security advisory corresponding to this fix for the actual attack mechanism and affected component.