EUVD-2026-99278
GHSA-3rxq-g8rj-r2cf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed .NET service
-
DeliverySend crafted high-complexity input
-
ExploitTrigger worst-case algorithmic processing
-
ExecutionExhaust CPU/memory resources
-
ImpactDenial of service for users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | No special configuration is required beyond exposing a .NET-based service to attacker-reachable network input: the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with low complexity and no user interaction against default behavior. The practical limiting factor is reachability - the vulnerable .NET code path must process attacker-supplied input (e.g., a listening web/API/network service on the affected runtime version); internal-only or non-.NET-facing deployments are not exposed. The exact affected .NET versions are not provided in the input and must be confirmed via the MSRC advisory to scope exposure. |
| Impact | This is a network-reachable, unauthenticated denial-of-service vulnerability in .NET (CWE-407, inefficient algorithmic complexity). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent and credible: the sole impact is availability (A:H) with no confidentiality or integrity effect, which matches an algorithmic-complexity DoS where crafted input forces worst-case processing. No EPSS score, CISA KEV entry, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - this should be treated as a patch-in-normal-cycle issue rather than an emergency, despite the 7.5 'High' rating. The signals are not conflicting so much as sparse: the only reference is a Microsoft MSRC advisory stub with no NVD enrichment, so EPSS, SSVC (automatable/technical-impact), and exploit-maturity data are simply absent, not low. One clear data defect: the sole tag is 'Authentication Bypass,' which directly contradicts the description (a DoS over the network with no privilege or integrity impact) and should be disregarded. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted input over the network to a service built on the affected .NET runtime, triggering a code path with worst-case algorithmic complexity (e.g., hashing, parsing, or collection handling). The excessive CPU or memory consumption degrades or halts the service for legitimate users. No public exploit code was identified at time of analysis, and the attack requires no user interaction or authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in Microsoft .NET lets an unauthenticated remote attacker force the runtime into disproportionately expensive computation, driving CPU or memory consumption high enough to degrade or halt a service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms remote, low-complexity, unauthenticated exploitation with no user interaction and a high availability-only impact, requiring only that the vulnerable .NET code path be reachable by attacker-supplied network input - no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. Exposure is limited to reachable, .NET-based services; internal-only or non-.NET-facing deployments are not affected, and the exact affected runtime versions must be confirmed against the MSRC advisory.
RemediationAI
No vendor-released patch version was identified in the provided data, so treat the Microsoft Update Guide entry (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69651) and your normal .NET servicing channel (Microsoft Update, or the .NET download and container image feeds) as the authoritative source for the fixed runtime build, and upgrade to that build as soon as it is published - patching the runtime is the only complete fix, since the weakness is algorithmic and cannot be fully corrected by configuration. Until an update is applied, apply compensating controls appropriate to an availability-only, unauthenticated network attack: front the service with a reverse proxy or gateway that enforces strict request body size limits, header and URL length caps, per-connection and total request timeouts, and per-client rate limiting; enable connection and concurrency limits and request-queue bounds at the host or ingress layer so a single expensive request cannot monopolize worker threads; and use WAF or ingress rules to drop anomalous payloads if the triggering pattern becomes known. Each of these carries trade-offs - aggressive timeouts and size caps will reject some legitimate large or long-running requests, and rate limiting can affect legitimate high-volume or NAT-shared clients - so tune thresholds against baseline traffic. Additionally, reduce the attack surface by restricting the affected endpoint to trusted networks or requiring authentication at a proxy where that is operationally possible, and monitor CPU, thread-pool queue length, and request latency for the sustained spikes characteristic of algorithmic-complexity exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-407 (Inefficient Algorithmic Complexity): the vulnerable .NET code path performs work that grows disproportionately relative to input size or repetition, so a relatively small, cheaply crafted request can consume disproportionate CPU, memory, or lock time on the server. This class of weakness is the basis of algorithmic-complexity denial of service - for example superlinear parsing or normalization, pathological hashing or comparison behavior, or repeated expensive operations triggered by a single crafted input - and it is distinct from memory-safety bugs, as reflected in the vector's C:N/I:N/A:H profile, which indicates availability loss with no confidentiality or integrity impact. The pre-authentication, low-complexity characteristics (AC:L, PR:N, UI:N) mean no credentials, no user interaction, and no race-condition-style timing are required, so the practical constraint is purely reachability of the affected code path from the network. Note that the supplied metadata carries an 'Authentication Bypass' tag that is inconsistent with both the description and the assessed CVSS vector's impact profile; no authentication or authorization bypass impact is supported by the available data, and any such claim should be treated as unverified until the MSRC advisory clarifies. No CPE strings or vendor-supplied version ranges were included in the provided intelligence, so the precise runtime, framework, and library versions implicated cannot be enumerated here.
Know when .NET gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated DoS with no user interaction (AV:N/AC:L/PR:N/UI:N); availability-only impact (A:H, C:N/I:N) matches an algorithmic-complexity resource-exhaustion flaw.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Technical POC Analysis
Advisory: GHSA-3rxq-g8rj-r2cf (MSRC), CVSS 3.1 7.5, CWE-407.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Microsoft .NET-based services that accept untrusted network input can be remotely driven into disproportionately expensive computation, degrading or halting service availability without any credentials or user interaction. Only internet- or partner-reachable .NET workloads are exposed - internal-only and non-.NET-facing deployments are not affected - but for those, the business consequence is availability loss in customer-facing APIs, web front ends, and middleware. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, and no vendor patch is available, so leadership should treat this as a resilience and mitigation-planning problem rather than an active incident.
No vendor-released patch identified at time of analysis. Interim mitigations: edge rate limiting and request-size/complexity limits at WAF or reverse proxy; shortened request timeouts and capped concurrency/thread-pool settings; CPU, memory, and process quotas with restart or circuit-breaker policies for .NET workloads; autoscaling tuned to absorb burst load; network segmentation or access restriction to reduce the number of .NET code paths reachable by untrusted input; continuous monitoring and alerting on CPU/memory saturation and latency regression.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Remote code execution affects Windows desktop applications built on the Microsoft.WindowsDesktop.App.Runtime (WPF) compo
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
Argument injection in the CliInvoke .NET process-wrapping library (and its former identity, AlastairLundy.CliInvoke) all
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Remote code execution in the ActiveMQ NMS AMQP .NET client affects all releases up to and including 2.3.0 when the clien
Exploit-DB