EUVD-2026-22404
GHSA-w3x6-4m5h-cxqf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
7DescriptionCVE.org
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust system resources through network-based uncontrolled resource consumption. Affects .NET 8.0 versions prior to 8.0.26, .NET 9.0 versions prior to 9.0.15, and .NET 10.0 versions prior to 10.0.6. Microsoft has released patches addressing CWE-400 resource exhaustion. No evidence of active exploitation (not listed in CISA KEV) at time of analysis, though the network-accessible, unauthenticated attack vector and low complexity (CVSS AV:N/AC:L/PR:N) present significant availability risk for internet-facing .NET applications.
Technical ContextAI
This vulnerability exploits CWE-400 (Uncontrolled Resource Consumption) within the Microsoft .NET runtime environment. Resource exhaustion flaws in application frameworks typically involve unbounded allocation of memory, CPU cycles, file handles, or network connections when processing malicious input. The .NET Framework handles numerous operations including HTTP request processing, serialization, XML/JSON parsing, and cryptographic operations - any of which could be vulnerable to algorithmic complexity attacks or resource amplification if input validation and resource limits are insufficient. The vulnerability affects three concurrent .NET release channels: the long-term support .NET 8.0 branch, the standard-term support .NET 9.0 branch, and the preview .NET 10.0 branch, indicating a shared code path or common component across these versions. The CPE identifiers confirm impact across all three major version families without platform-specific restrictions, suggesting the flaw exists in cross-platform .NET runtime components rather than OS-specific implementations.
RemediationAI
Organizations should upgrade to patched .NET runtime versions released by Microsoft. For .NET 8.0 deployments, upgrade to version 8.0.26 or later. For .NET 9.0 deployments, upgrade to version 9.0.15 or later. For .NET 10.0 deployments, upgrade to version 10.0.6 or later. The upgrade process typically involves updating the .NET runtime on host systems and redeploying applications targeting the affected framework versions. For containerized deployments, rebuild container images using patched base images from Microsoft Container Registry. Consult the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171 for platform-specific installation guidance and any additional configuration requirements. Until patching is complete, consider implementing network-layer rate limiting, request throttling, and resource quotas at the web server or load balancer level to mitigate potential resource exhaustion attacks against exposed .NET applications.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today