EUVD-2026-22404
GHSA-w3x6-4m5h-cxqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed .NET application
-
DeliveryCraft resource-exhaustion payload
-
ExploitSend malicious network requests
-
ExecutionTrigger uncontrolled resource allocation
-
PersistExhaust system resources
-
ImpactApplication becomes unresponsive
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit default .NET installations (versions not specified in description) by sending malicious network requests causing uncontrolled resource consumption. No special configuration, authentication, or victim interaction required. |
| Impact | The CVSS base score of 7.5 (High severity) reflects significant availability impact (A:H) with a network attack vector requiring no authentication (AV:N/PR:N) and low attack complexity (AC:L). However, the scope is unchanged (S:U) and there is no confidentiality or integrity impact (C:N/I:N), limiting this to pure denial-of-service. The ease of exploitation (no special privileges, no user interaction required) makes this accessible to unsophisticated attackers against any internet-exposed .NET application. No EPSS score is provided in the intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in the wild at analysis time. No public proof-of-concept code is identified in the provided references. From an SSVC perspective: exploitation status is 'none' (no public POC confirmed), automatable is 'yes' (network-based, no auth), technical impact is 'partial' (availability only). Real-world risk is elevated for public-facing .NET web applications and APIs where availability is business-critical, but this is not a data breach or remote code execution scenario. Organizations can prioritize patching based on asset criticality and internet exposure rather than treating this as an emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a public-facing .NET web application or API running a vulnerable runtime version through banner grabbing or framework fingerprinting. The attacker crafts specially formed HTTP requests designed to trigger excessive resource allocation in the .NET runtime's request processing pipeline, such as deeply nested JSON structures, extremely large XML documents, or patterns that cause algorithmic complexity explosions in parsing or validation routines. By sending a high volume of these malicious requests from distributed sources or through amplification techniques, the attacker exhausts available memory, CPU, or connection pools on the target server, causing the application to become unresponsive to legitimate users and potentially crashing the worker process or application pool. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust system resources through network-based uncontrolled resource consumption. Affects .NET 8.0 versions prior to 8.0.26, .NET 9.0 versions prior to 9.0.15, and .NET 10.0 versions prior to 10.0.6. Microsoft has released patches addressing CWE-400 resource exhaustion. No evidence of active exploitation (not listed in CISA KEV) at time of analysis, though the network-accessible, unauthenticated attack vector and low complexity (CVSS AV:N/AC:L/PR:N) present significant availability risk for internet-facing .NET applications.
RemediationAI
Organizations should upgrade to patched .NET runtime versions released by Microsoft. For .NET 8.0 deployments, upgrade to version 8.0.26 or later. For .NET 9.0 deployments, upgrade to version 9.0.15 or later. For .NET 10.0 deployments, upgrade to version 10.0.6 or later. The upgrade process typically involves updating the .NET runtime on host systems and redeploying applications targeting the affected framework versions. For containerized deployments, rebuild container images using patched base images from Microsoft Container Registry. Consult the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171 for platform-specific installation guidance and any additional configuration requirements. Until patching is complete, consider implementing network-layer rate limiting, request throttling, and resource quotas at the web server or load balancer level to mitigate potential resource exhaustion attacks against exposed .NET applications.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in microsoft, nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits CWE-400 (Uncontrolled Resource Consumption) within the Microsoft .NET runtime environment. Resource exhaustion flaws in application frameworks typically involve unbounded allocation of memory, CPU cycles, file handles, or network connections when processing malicious input. The .NET Framework handles numerous operations including HTTP request processing, serialization, XML/JSON parsing, and cryptographic operations - any of which could be vulnerable to algorithmic complexity attacks or resource amplification if input validation and resource limits are insufficient. The vulnerability affects three concurrent .NET release channels: the long-term support .NET 8.0 branch, the standard-term support .NET 9.0 branch, and the preview .NET 10.0 branch, indicating a shared code path or common component across these versions. The CPE identifiers confirm impact across all three major version families without platform-specific restrictions, suggesting the flaw exists in cross-platform .NET runtime components rather than OS-specific implementations.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Microsoft .NET Framework versions 8.0, 9.0, and 10.0 contain a remotely exploitable denial-of-service vulnerability that allows unauthenticated attackers to crash or degrade availability of internet-facing applications through resource exhaustion. Organizations running these .NET versions in production must patch immediately to prevent service disruptions and potential business continuity impact.
Apply vendor patch. If immediate patching is not feasible, implement network-based rate limiting and request throttling on load balancers; configure connection timeouts and resource quotas at the application server level; restrict network exposure of .NET applications through firewall rules or WAF policies; monitor CPU and memory utilization for anomalous resource consumption patterns indicative of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB