EUVD-2026-44406
GHSA-wp74-jgxh-gv4q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-facing .NET endpoint
-
DeliverySend crafted resource-heavy requests
-
ExploitTrigger unbounded allocation (CWE-770)
-
ExecutionExhaust memory/threads/connections
-
ImpactService crash or unavailability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against network-reachable Microsoft .NET applications built on the affected 8.0/9.0/10.0 runtimes. The practical prerequisite is that the target exposes a .NET-based network endpoint the attacker can reach; the input description does not name a specific protocol, feature, or configuration toggle required, so the precise triggering component is not confirmed from available data. Limiting factors: the impact is availability-only (no data compromise), the target must be network-accessible to the attacker, and hosts already behind rate-limiting/size-limiting proxies are harder to affect. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with impact limited entirely to availability (no confidentiality or integrity loss). This is a genuine remotely-triggerable DoS rather than an RCE, so severity is capped at HIGH by the availability-only impact. No EPSS score, POC, or KEV status was provided in the input, so exploitation likelihood cannot be quantified from these signals; the absence of KEV means no confirmed active exploitation, and no public exploit was identified. Priority should be driven by exposure - internet-facing .NET services warrant prompt patching because the attack is trivial to launch and unauthenticated, whereas internal-only workloads carry lower urgency. No SSVC decision data was supplied, and EPSS is unknown, so realistic exploitation frequency remains unverified. |
| Exploit ScenarioDerived | An attacker with network reachability to an internet-facing .NET service sends crafted or high-volume requests that coerce the runtime into allocating resources without bound, driving memory, thread, or connection consumption until the process degrades or crashes. Because no authentication or user interaction is required and attack complexity is low, this can be scripted and repeated to sustain an outage. No public POC was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) allows an unauthorized remote attacker to exhaust system resources and render affected applications unavailable. The flaw stems from allocation of resources without limits or throttling, meaning a single crafted network interaction can trigger disproportionate resource consumption. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: apply the updates published in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50651 - install the latest servicing release for your .NET 8.0, 9.0, or 10.0 runtime/SDK and the corresponding Visual Studio 2022 (17.12/17.14) or 2026 (18.7) update; the exact patched build numbers are listed in the MSRC guide. Rebuild and redeploy self-contained applications against the patched runtime, as framework-dependent apps also require the updated shared runtime on hosts. Until patching completes, reduce exposure by placing affected services behind a reverse proxy or WAF that enforces request rate limiting, connection caps, and request/body size limits, and restrict network reachability of the service to trusted clients; these controls blunt resource-exhaustion attempts but may reject legitimate large or bursty traffic and add latency, so tune thresholds to your workload.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the .NET runtime/base libraries (Microsoft .NET 8.0, 9.0, and 10.0), the cross-platform managed framework underpinning ASP.NET Core web services, gRPC endpoints, and other network-facing .NET workloads; the Visual Studio 2022 (17.12/17.14) and 2026 (18.7) entries are affected because they ship the same runtime/SDK components. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): code paths that process attacker-controlled network input allocate memory, threads, connections, or other resources without enforcing an upper bound, so an attacker can force unbounded growth. This class of bug is common in request parsers, deserializers, and connection/stream handlers that trust size or count fields supplied by a remote peer.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity network trigger with no user interaction; impact is availability-only resource exhaustion, so C and I are N and A is H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) and Visual Studio 2022/2026 are vulnerable to a network-based denial of service attack that can crash applications with a single malicious request, impacting availability of any organization relying on these platforms. An unauthenticated attacker can trigger this flaw remotely without special privileges, making this an immediate risk to business continuity across applications and development infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB