EUVD-2026-22635
GHSA-37gx-xxp4-5rgx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
7DescriptionCVE.org
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
AnalysisAI
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust server resources via specially crafted network requests. The vulnerability (CWE-835) stems from unreachable loop exit conditions in core .NET processing logic, enabling complete service disruption with low attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions — remote unauthenticated exploitation against default .NET, .NET Framework, or Visual Studio configurations susceptible to infinite loop triggering via network requests. Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability presents moderate-to-high real-world risk despite the 7.5 CVSS score, driven primarily by its unauthenticated network attack surface and low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a public-facing ASP.NET web application running vulnerable .NET Framework 4.8 or .NET 8.0 runtime. The attacker crafts malicious HTTP requests containing specially formatted input data designed to trigger vulnerable parsing routines in the .NET stack-such as malformed XML, JSON payloads with recursive references, or edge-case string encodings. … |
| Remediation | Apply vendor-released security updates immediately for all affected .NET installations. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running affected .NET versions (Framework 3.5-4.8.1, .NET 8.0, 9.0, 10.0) and prioritize internet-facing applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today