EUVD-2026-44393
GHSA-8q5v-6pqq-x66h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed .NET service
-
DeliverySend crafted request(s)
-
ExploitTrigger unbounded resource allocation
-
ExecutionExhaust memory/threads
-
ImpactService becomes unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against network-reachable .NET 8.0/9.0/10.0 applications. The attacker only needs network access to a service built on the affected runtime that processes untrusted input; the impact is limited to availability (A:H only, C:N/I:N), so exploitation degrades or crashes the service but does not yield code execution, data disclosure, or tampering. Practical exposure is bounded to workloads that actually accept the vulnerable network input path - non-networked or internal-only .NET applications behind strong network segmentation face materially lower real-world risk. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes a low-complexity, unauthenticated, network-reachable attack with high availability impact but no confidentiality or integrity impact - a classic remotely-triggerable DoS. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation likelihood cannot be quantified from the input; the signals present (easy vector, no auth) argue for a real but availability-limited risk rather than a data-breach emergency. There is no conflict between the CVSS vector and the description - both point to unauthenticated network DoS. Prioritize patching internet-facing .NET services promptly, but this is not a code-execution or data-exposure incident, so it ranks below RCE/EoP classes of the same CVSS band. |
| Exploit ScenarioDerived | An attacker on the network sends specially crafted requests to an internet-facing ASP.NET Core service running an unpatched .NET runtime, each triggering disproportionate memory or thread allocation. With low attack complexity and no authentication or user interaction required, a modest volume of requests exhausts server resources and makes the application unresponsive to legitimate users. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaust server resources and render applications unresponsive by exploiting uncontrolled resource allocation (CWE-770) in the runtime. The flaw carries CVSS 7.5 (availability-only impact) and affects the shared .NET runtime that underpins ASP.NET Core web services, so any internet-facing .NET workload is exposed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a fix.
RemediationAI
Vendor-released patch: available from Microsoft - apply the updated .NET 8.0/9.0/10.0 runtime and SDK releases referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525), and update Visual Studio 2022 to 17.12/17.14 or Visual Studio 2026 to 18.7 where the SDK is consumed. On servers, update the shared framework/hosting bundle and restart affected ASP.NET Core apps so the patched runtime is loaded; self-contained deployments must be rebuilt against the patched runtime and redeployed since they carry their own copy. Until patched, reduce exposure by placing affected services behind a reverse proxy or WAF that enforces request-rate limiting and connection/timeout caps, and restrict network reachability of the vulnerable endpoints to trusted callers - trade-off is added latency and possible false-positive throttling of legitimate bursts, and these controls only blunt, not eliminate, the resource-exhaustion vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in the .NET runtime/framework libraries (CPE identifies microsoft:.net_8.0, .net_9.0, and .net_10.0, with the same fix shipping through Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7 which bundle the SDK). The root cause class is CWE-770, Allocation of Resources Without Limits or Throttling: some code path processes attacker-supplied network input without bounding the memory, threads, or handles it allocates, so a modest request can force disproportionate resource consumption. Because .NET is the base execution layer for ASP.NET Core and Kestrel-hosted services, the weakness is reachable through normal request-handling paths rather than a niche feature. Microsoft has not published the specific component (e.g., a parser, HTTP/2 handling, or a collection) in the available data.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network input triggers uncontrolled allocation with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Microsoft .NET runtime versions 8.0, 9.0, and 10.0 contain a denial-of-service vulnerability exploitable by unauthenticated remote attackers; no public exploit has been identified at time of analysis. Any organization running internet-facing .NET applications faces potential service outages that could impact customer access, revenue, and operational reputation. A vendor patch is available and should be deployed across affected systems within 7 days.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB