EUVD-2026-29719
GHSA-9v76-4qcc-frgh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing ASP.NET Core endpoint
-
DeliverySend crafted HTTP request
-
ExploitTrigger unreachable loop exit (CWE-835)
-
ExecutionWorker thread spins at 100% CPU
-
PersistRepeat requests to exhaust thread pool
-
ImpactService becomes unavailable (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation is possible against default configurations of any ASP.NET Core service built on the vulnerable .NET 8.0 (<8.0.27), 9.0 (<9.0.16), or 10.0 (<10.0.8) runtimes, consistent with AV:N/AC:L/PR:N/UI:N. The only real prerequisites are network reachability to the ASP.NET Core endpoint and that the target runs an unpatched affected runtime version. Limiting factors: the impact is confined to availability (no data exposure or code execution), the target must be reachable by the attacker (internal-only services behind a firewall are lower risk), and applications already fronted by proxies/WAFs enforcing strict request timeouts and rate limits are harder to keep in a degraded state. |
| Impact | The signals are largely consistent and point to a real but moderate operational risk rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates a low-complexity, network-reachable, unauthenticated attack with high availability impact but no data compromise. Countervailing signals temper urgency: EPSS is only 0.04% (12th percentile), CISA SSVC records Exploitation as 'none' and Technical Impact as only 'partial', and there is no CISA KEV listing. However, SSVC marks the issue 'Automatable: yes', meaning attacks can be scripted and repeated at scale, and public exploit code (a GitHub gist) already exists, so weaponization effort is low. The vendor advisory also carries temporal metrics E:U/RL:O/RC:C (exploit unproven, official remediation available, confirmed report), reinforcing that a fix exists and in-the-wild exploitation is not confirmed. Net: prioritize patching for internet-facing ASP.NET Core services, but this is a resource-exhaustion DoS, not code execution or data loss. |
| Exploit ScenarioDerived | An attacker identifies an internet-facing ASP.NET Core application running an unpatched .NET 8/9/10 runtime and sends a crafted HTTP request whose input drives request-processing code into an infinite loop. The affected worker thread spins at 100% CPU and never returns; repeating the request across multiple connections (the attack is scriptable per SSVC 'Automatable: yes') exhausts the thread pool and makes the service unavailable to legitimate users. Public proof-of-concept code exists as a GitHub gist, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted network requests that trigger a loop with an unreachable exit condition (CWE-835), pinning CPU and rendering the application unresponsive. Publicly available exploit code exists, though there is no public exploit identified as being used in active attacks; EPSS is very low (0.04%, 12th percentile), consistent with the CISA SSVC 'Exploitation: none' assessment. Microsoft has released fixed runtime packages, and the flaw is availability-only with no confidentiality or integrity impact.
RemediationAI
Upgrade the .NET runtime and the Microsoft.AspNetCore.App.Runtime packages to the fixed releases: 8.0.27 for the 8.0 branch, 9.0.16 for the 9.0 branch, and 10.0.8 for the 10.0 branch (Vendor-released patch confirmed by Microsoft GHSA-9v76-4qcc-frgh). Framework-dependent applications should install the updated shared runtime on all hosts and restart the affected services; self-contained deployments must be rebuilt against the patched runtime packages and redeployed, since the fix ships in the runtime rather than in application code. Red Hat users should apply the corresponding RHSA errata (e.g., RHSA-2026:21286/21754) via their package manager. No vendor workaround is published; because the flaw is triggered by network requests, interim compensating controls are to place vulnerable services behind a reverse proxy or WAF with aggressive request timeouts and rate limiting, and to constrain per-connection request duration and worker recycling so a spinning thread is reaped rather than left to exhaust the pool - with the trade-off that timeouts too aggressively set may terminate legitimate long-running requests. Refer to the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899) and announcement issue https://github.com/dotnet/announcements/issues/397 for exact package guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 15 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in ASP.NET Core, the cross-platform web framework shipped as part of the Microsoft.AspNetCore.App runtime for .NET. CPE data confirms the affected products are microsoft:.net_8.0, microsoft:.net_9.0, and microsoft:.net_10.0, meaning any web application or service built on these runtime versions is exposed regardless of OS or CPU architecture (the advisory notes Platforms: All, Architectures: All). The root cause is CWE-835, 'Loop with Unreachable Exit Condition (Infinite Loop)': a code path in request processing enters a loop whose termination condition can never be satisfied given attacker-influenced input, so the worker thread spins indefinitely. Because this consumes thread/CPU resources on the server side without requiring authentication, a small number of malicious requests can exhaust processing capacity.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated request triggers an infinite loop causing high availability impact only, with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Organizations relying on ASP.NET Core versions 8.0, 9.0, or 10.0 face denial-of-service risk that could disable critical services without requiring authentication or access credentials. With functional attack code publicly available and no current active exploitation, the window to patch before opportunistic attacks is open but narrow. Deployment of Microsoft's released patches is the immediate priority to eliminate this application-availability risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
Exploit-DB