EUVD-2026-22635
GHSA-37gx-xxp4-5rgx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
7DescriptionCVE.org
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
AnalysisAI
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust server resources via specially crafted network requests. The vulnerability (CWE-835) stems from unreachable loop exit conditions in core .NET processing logic, enabling complete service disruption with low attack complexity. Vendor-released patches are available across all affected product lines. No public exploit identified at
Technical ContextAI
This vulnerability exploits CWE-835 (Loop with Unreachable Exit Condition), a class of defects where program logic enters an iterative loop that cannot terminate due to flawed exit condition evaluation. In the .NET runtime and framework context, this manifests when processing certain network inputs triggers parsing or validation routines with infinite recursion or iteration paths. The affected CPE strings span Microsoft .NET Framework legacy versions (3.5, 4.6.2-4.8.1) used in Windows Server environments and modern cross-platform .NET implementations (8.0, 9.0, 10.0). The CVSS vector confirms network-accessible exploitation (AV:N) with no required privileges (PR:N) or user interaction (UI:N), indicating the vulnerable code paths are exposed through public-facing network services like ASP.NET applications, WCF endpoints, or HTTP handlers. The high availability impact (A:H) with unchanged scope (S:U) suggests resource exhaustion affects only the vulnerable component rather than cascading to other systems.
RemediationAI
Apply vendor-released security updates immediately for all affected .NET installations. For .NET 8.0, upgrade to version 8.0.26 or later. For .NET 9.0, upgrade to version 9.0.15 or later. For .NET 10.0, upgrade to version 10.0.6 or later. For .NET Framework 4.8 standalone, upgrade to version 4.8.4801.0 or later. For .NET Framework combination packages (3.5+4.7.2, 3.5+4.8, 3.5+4.8.1), apply cumulative updates meeting minimum build thresholds specified in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116). For .NET Framework 3.5 standalone, upgrade to builds 2.0.50727.8982/3.0.30729.8976 or later. Patches are distributed through Windows Update, Microsoft Update Catalog, and .NET SDK installers depending on deployment model. No effective workarounds exist beyond applying patches, though rate-limiting and web application firewall rules may provide partial mitigation by throttling malicious request patterns. Verify patch application using dotnet --list-runtimes and dotnet --list-sdks commands or by checking installed Windows updates for framework versions.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today