EUVD-2026-44393
GHSA-8q5v-6pqq-x66h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network input triggers uncontrolled allocation with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
AnalysisAI
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaust server resources and render applications unresponsive by exploiting uncontrolled resource allocation (CWE-770) in the runtime. The flaw carries CVSS 7.5 (availability-only impact) and affects the shared .NET runtime that underpins ASP.NET Core web services, so any internet-facing .NET workload is exposed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a fix.
Technical ContextAI
The vulnerability lies in the .NET runtime/framework libraries (CPE identifies microsoft:.net_8.0, .net_9.0, and .net_10.0, with the same fix shipping through Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7 which bundle the SDK). The root cause class is CWE-770, Allocation of Resources Without Limits or Throttling: some code path processes attacker-supplied network input without bounding the memory, threads, or handles it allocates, so a modest request can force disproportionate resource consumption. Because .NET is the base execution layer for ASP.NET Core and Kestrel-hosted services, the weakness is reachable through normal request-handling paths rather than a niche feature. Microsoft has not published the specific component (e.g., a parser, HTTP/2 handling, or a collection) in the available data.
RemediationAI
Vendor-released patch: available from Microsoft - apply the updated .NET 8.0/9.0/10.0 runtime and SDK releases referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525), and update Visual Studio 2022 to 17.12/17.14 or Visual Studio 2026 to 18.7 where the SDK is consumed. On servers, update the shared framework/hosting bundle and restart affected ASP.NET Core apps so the patched runtime is loaded; self-contained deployments must be rebuilt against the patched runtime and redeployed since they carry their own copy. Until patched, reduce exposure by placing affected services behind a reverse proxy or WAF that enforces request-rate limiting and connection/timeout caps, and restrict network reachability of the vulnerable endpoints to trusted callers - trade-off is added latency and possible false-positive throttling of legitimate bursts, and these controls only blunt, not eliminate, the resource-exhaustion vector.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today