EUVD-2026-29719
GHSA-9v76-4qcc-frgh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated request triggers an infinite loop causing high availability impact only, with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
AnalysisAI
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted network requests that trigger a loop with an unreachable exit condition (CWE-835), pinning CPU and rendering the application unresponsive. Publicly available exploit code exists, though there is no public exploit identified as being used in active attacks; EPSS is very low (0.04%, 12th percentile), consistent with the CISA SSVC 'Exploitation: none' assessment. Microsoft has released fixed runtime packages, and the flaw is availability-only with no confidentiality or integrity impact.
Technical ContextAI
The vulnerability lies in ASP.NET Core, the cross-platform web framework shipped as part of the Microsoft.AspNetCore.App runtime for .NET. CPE data confirms the affected products are microsoft:.net_8.0, microsoft:.net_9.0, and microsoft:.net_10.0, meaning any web application or service built on these runtime versions is exposed regardless of OS or CPU architecture (the advisory notes Platforms: All, Architectures: All). The root cause is CWE-835, 'Loop with Unreachable Exit Condition (Infinite Loop)': a code path in request processing enters a loop whose termination condition can never be satisfied given attacker-influenced input, so the worker thread spins indefinitely. Because this consumes thread/CPU resources on the server side without requiring authentication, a small number of malicious requests can exhaust processing capacity.
RemediationAI
Upgrade the .NET runtime and the Microsoft.AspNetCore.App.Runtime packages to the fixed releases: 8.0.27 for the 8.0 branch, 9.0.16 for the 9.0 branch, and 10.0.8 for the 10.0 branch (Vendor-released patch confirmed by Microsoft GHSA-9v76-4qcc-frgh). Framework-dependent applications should install the updated shared runtime on all hosts and restart the affected services; self-contained deployments must be rebuilt against the patched runtime packages and redeployed, since the fix ships in the runtime rather than in application code. Red Hat users should apply the corresponding RHSA errata (e.g., RHSA-2026:21286/21754) via their package manager. No vendor workaround is published; because the flaw is triggered by network requests, interim compensating controls are to place vulnerable services behind a reverse proxy or WAF with aggressive request timeouts and rate limiting, and to constrain per-connection request duration and worker recycling so a spinning thread is reaped rather than left to exhaust the pool - with the trade-off that timeouts too aggressively set may terminate legitimate long-running requests. Refer to the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899) and announcement issue https://github.com/dotnet/announcements/issues/397 for exact package guidance.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today