EUVD-2026-22635
GHSA-37gx-xxp4-5rgx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted network request
-
ExploitTrigger infinite loop in .NET parser
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default .NET, .NET Framework, or Visual Studio configurations susceptible to infinite loop triggering via network requests. |
| Impact | This vulnerability presents moderate-to-high real-world risk despite the 7.5 CVSS score, driven primarily by its unauthenticated network attack surface and low complexity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation requirements-attackers need only network connectivity and basic protocol knowledge to trigger the infinite loop condition. However, several factors temper immediate risk: no public exploit identified at time of analysis per available intelligence, no CISA KEV listing confirming active exploitation, and vendor patches available across all affected versions. EPSS probability data not provided, but the pure availability impact (C:N/I:N/A:H) makes this less attractive than RCE vulnerabilities for sophisticated actors. From an SSVC perspective, technical impact is partial (DoS only), exploitation is plausible given network accessibility but not confirmed as active, and automatable exploitation is likely given the deterministic nature of infinite loops. Priority should focus on internet-facing .NET applications and high-availability services where prolonged downtime has business impact. Internal applications with network segmentation face lower risk. The broad version range (spanning .NET Framework 3.5 from 2008 through .NET 10.0 released in 2025) indicates a systemic design issue rather than isolated regression, suggesting thorough testing before deployment in production environments. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a public-facing ASP.NET web application running vulnerable .NET Framework 4.8 or .NET 8.0 runtime. The attacker crafts malicious HTTP requests containing specially formatted input data designed to trigger vulnerable parsing routines in the .NET stack-such as malformed XML, JSON payloads with recursive references, or edge-case string encodings. Upon processing these requests, the .NET runtime enters an infinite loop in validation or deserialization logic, consuming CPU cycles indefinitely. Within minutes, sustained request flooding exhausts available worker threads and CPU resources, rendering the application unresponsive to legitimate users. The attack requires minimal technical sophistication and generates complete service denial until server administrators forcibly restart IIS or application pools. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust server resources via specially crafted network requests. The vulnerability (CWE-835) stems from unreachable loop exit conditions in core .NET processing logic, enabling complete service disruption with low attack complexity. Vendor-released patches are available across all affected product lines. No public exploit identified at
Earlier versions of this analysis (1)
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust server resources via specially crafted network requests. The vulnerability (CWE-835) stems from unreachable loop exit conditions in core .NET processing logic, enabling complete service disruption with low attack complexity. Vendor-released patches are available across all affected product lines. No public exploit identified at time of analysis, though the network-accessible attack vector and lack of authentication requirements (CVSS:3.1 AV:N/PR:N) make this an attractive target for opportunistic DoS campaigns.
RemediationAI
Apply vendor-released security updates immediately for all affected .NET installations. For .NET 8.0, upgrade to version 8.0.26 or later. For .NET 9.0, upgrade to version 9.0.15 or later. For .NET 10.0, upgrade to version 10.0.6 or later. For .NET Framework 4.8 standalone, upgrade to version 4.8.4801.0 or later. For .NET Framework combination packages (3.5+4.7.2, 3.5+4.8, 3.5+4.8.1), apply cumulative updates meeting minimum build thresholds specified in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116). For .NET Framework 3.5 standalone, upgrade to builds 2.0.50727.8982/3.0.30729.8976 or later. Patches are distributed through Windows Update, Microsoft Update Catalog, and .NET SDK installers depending on deployment model. No effective workarounds exist beyond applying patches, though rate-limiting and web application firewall rules may provide partial mitigation by throttling malicious request patterns. Verify patch application using dotnet --list-runtimes and dotnet --list-sdks commands or by checking installed Windows updates for framework versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 25 packages in microsoft, nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits CWE-835 (Loop with Unreachable Exit Condition), a class of defects where program logic enters an iterative loop that cannot terminate due to flawed exit condition evaluation. In the .NET runtime and framework context, this manifests when processing certain network inputs triggers parsing or validation routines with infinite recursion or iteration paths. The affected CPE strings span Microsoft .NET Framework legacy versions (3.5, 4.6.2-4.8.1) used in Windows Server environments and modern cross-platform .NET implementations (8.0, 9.0, 10.0). The CVSS vector confirms network-accessible exploitation (AV:N) with no required privileges (PR:N) or user interaction (UI:N), indicating the vulnerable code paths are exposed through public-facing network services like ASP.NET applications, WCF endpoints, or HTTP handlers. The high availability impact (A:H) with unchanged scope (S:U) suggests resource exhaustion affects only the vulnerable component rather than cascading to other systems.
Know when Microsoft Net Framework 3 5 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
Executive ViewAI
CVE-2026-33116 is a high-severity denial-of-service vulnerability affecting Microsoft .NET Framework 3.5-4.8.1 and .NET 8.0-10.0 that allows unauthenticated remote attackers to crash .NET applications through specially crafted network requests, potentially disrupting critical business services dependent on these frameworks without requiring valid credentials or user interaction.
Apply vendor patch. If immediate patching is not feasible, implement network-level rate limiting and connection filtering on affected .NET services, restrict network access to trusted sources only, and increase server resource monitoring to detect and respond to DoS patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Microsoft Net Framework 3 5
View allLocal privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Local code execution in Microsoft .NET (Framework 3.5 through 4.8.1, .NET 8.0/9.0, and Visual Studio 2022/2026) arises f
Local privilege elevation in Microsoft .NET Framework (and .NET 8.0/9.0 plus Visual Studio 2022/2026) via code injection
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the legacy .NET Framework (3.5 through 4.8.1) allo
Denial of service in Microsoft .NET (including .NET 8.0/9.0/10.0 and .NET Framework 3.5 through 4.8.1) lets a remote una
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and .NET Framework (3.5 through 4.8.1) allows a remote
Denial of service in Microsoft .NET Framework 3.5 through 4.8.1 allows unauthenticated remote attackers to crash applica
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB