EUVD-2026-44406
GHSA-wp74-jgxh-gv4q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity network trigger with no user interaction; impact is availability-only resource exhaustion, so C and I are N and A is H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
AnalysisAI
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) allows an unauthorized remote attacker to exhaust system resources and render affected applications unavailable. The flaw stems from allocation of resources without limits or throttling, meaning a single crafted network interaction can trigger disproportionate resource consumption. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The vulnerability lives in the .NET runtime/base libraries (Microsoft .NET 8.0, 9.0, and 10.0), the cross-platform managed framework underpinning ASP.NET Core web services, gRPC endpoints, and other network-facing .NET workloads; the Visual Studio 2022 (17.12/17.14) and 2026 (18.7) entries are affected because they ship the same runtime/SDK components. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): code paths that process attacker-controlled network input allocate memory, threads, connections, or other resources without enforcing an upper bound, so an attacker can force unbounded growth. This class of bug is common in request parsers, deserializers, and connection/stream handlers that trust size or count fields supplied by a remote peer.
RemediationAI
Vendor-released patch: apply the updates published in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50651 - install the latest servicing release for your .NET 8.0, 9.0, or 10.0 runtime/SDK and the corresponding Visual Studio 2022 (17.12/17.14) or 2026 (18.7) update; the exact patched build numbers are listed in the MSRC guide. Rebuild and redeploy self-contained applications against the patched runtime, as framework-dependent apps also require the updated shared runtime on hosts. Until patching completes, reduce exposure by placing affected services behind a reverse proxy or WAF that enforces request rate limiting, connection caps, and request/body size limits, and restrict network reachability of the service to trusted clients; these controls blunt resource-exhaustion attempts but may reject legitimate large or bursty traffic and add latency, so tune thresholds to your workload.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today