What is the CVSS score of CVE-2026-50648?

CVE-2026-50648 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of .NET are affected by CVE-2026-50648?

A remotely exploitable denial-of-service vulnerability in Microsoft .NET (versions 8.0-10.0) and .NET Framework (3.5-4.8.1) allows unauthenticated attackers to exhaust server resources and crash…. A patch is available.

How to fix or mitigate CVE-2026-50648?

Within 24 hours, inventory all .NET deployments to identify affected versions (8.0, 9.0, 10.0, and Framework 3.5-4.8.1) and prioritize network-facing applications. Within 7 days, obtain the vendor patch from Microsoft, test it in a non-production environment that mirrors production, and begin staged rollout to production systems. Within 30 days, complete patching across all affected .NET instances and validate remediation.

.NET CVE-2026-50648

EUVD-2026-44398 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-23rf-6693-g89p

Denial Of Service Microsoft Red Hat Suse Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity network DoS with no user interaction; availability-only impact (A:H) and no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:43 vuln.today

CVE Published

Jul 14, 2026 - 19:29 nvd

HIGH 7.5

DescriptionCVE.org

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft .NET (including .NET 8.0/9.0/10.0 and .NET Framework 3.5 through 4.8.1) lets a remote unauthenticated attacker exhaust server resources by sending crafted network traffic that triggers unbounded resource allocation. Rated CVSS 7.5 with availability-only impact, it affects default configurations of network-facing .NET applications; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) weakness in Microsoft's .NET runtime and the legacy .NET Framework. Affected components span the modern cross-platform runtime (.NET 8.0, 9.0, 10.0) and the Windows-only .NET Framework versions 3.5, 4.6.2, 4.7.x, 4.8, and 4.8.1 per the CPE data, plus tooling shipped in Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 18.7. CWE-770 flaws typically arise when a request handler or parser allocates memory, threads, connections, or buffers proportional to attacker-controlled input without enforcing a cap, so a small malicious request can consume disproportionate CPU or memory.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648 for each affected .NET and .NET Framework channel via Windows Update or the .NET update packages, and update affected Visual Studio 2022/2026 installations to the latest servicing release. No exact fixed version string is provided in the input, so consult the MSRC update guide for the precise build per platform. Where immediate patching is not possible, reduce exposure by restricting network reachability of the affected .NET service (firewall or allowlist to trusted clients), placing it behind a reverse proxy or WAF that enforces request-size and rate limits, and applying application-level connection and request throttling - with the trade-off that these controls mitigate but do not eliminate the underlying unbounded-allocation defect and may throttle legitimate high-volume clients.