.NET Denial of Service Vulnerability
Priority MEDIUM 42CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub, Red Hat and Microsoft. Impact type from Microsoft.
Summary
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01753 78th percentileScored 2026-11-07
Fix Fixed System.Security.Cryptography.Xml (NuGet): 10.0.6, 9.0.15, 8.0.3Red Hat: 17 advisoriesMicrosoft: 3 updates
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | .NET 10.0 | 10.0.0 to before 10.0.6 | 10.0.6 | Patch available | CNA |
| Microsoft | .NET 8.0 | 8.0.0 to before 8.0.26 | 8.0.26 | Patch available | CNA |
| Microsoft | .NET 9.0 | 9.0.0 to before 9.0.15 | 9.0.15 | Patch available | CNA |
| Microsoft | PowerShell 7.5 | 7.5.0 to before 7.5.6 | 7.5.6 | Patch available | CNA |
| Microsoft | PowerShell 7.6 | 7.6.0 to before 7.6.1 | 7.6.1 | Patch available | CNA |
| — | System.Security.Cryptography.Xml (NuGet) | 10.0.0 to before 10.0.6 | 10.0.6 | Patch available | GHSA-w3x6-4m5h-cxqf |
| — | System.Security.Cryptography.Xml (NuGet) | 9.0.0 to before 9.0.15 | 9.0.15 | Patch available | GHSA-w3x6-4m5h-cxqf |
| — | System.Security.Cryptography.Xml (NuGet) | 8.0.0 to before 8.0.3 | 8.0.3 | Patch available | GHSA-w3x6-4m5h-cxqf |
- .NET 10.0 VendorMicrosoft Affected 10.0.0 to before 10.0.6 Fixed in 10.0.6 Patch available CNA
- .NET 8.0 VendorMicrosoft Affected 8.0.0 to before 8.0.26 Fixed in 8.0.26 Patch available CNA
- .NET 9.0 VendorMicrosoft Affected 9.0.0 to before 9.0.15 Fixed in 9.0.15 Patch available CNA
- PowerShell 7.5 VendorMicrosoft Affected 7.5.0 to before 7.5.6 Fixed in 7.5.6 Patch available CNA
- PowerShell 7.6 VendorMicrosoft Affected 7.6.0 to before 7.6.1 Fixed in 7.6.1 Patch available CNA
- System.Security.Cryptography.Xml (NuGet) Vendor— Affected 10.0.0 to before 10.0.6 Fixed in 10.0.6 Patch available GHSA-w3x6-4m5h-cxqf
- System.Security.Cryptography.Xml (NuGet) Vendor— Affected 9.0.0 to before 9.0.15 Fixed in 9.0.15 Patch available GHSA-w3x6-4m5h-cxqf
- System.Security.Cryptography.Xml (NuGet) Vendor— Affected 8.0.0 to before 8.0.3 Fixed in 8.0.3 Patch available GHSA-w3x6-4m5h-cxqf
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 10.0.0 to before 10.0.6 | Vulnerable | Microsoft |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 8.0.0 to before 8.0.26 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 9.0.0 to before 9.0.15 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:* | 7.5 to before 7.5.6; 7.6 to before 7.6.1 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.0.6 Vulnerable ·Microsoft
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.26 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.0.15 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:* Versions 7.5 to before 7.5.6; 7.6 to before 7.6.1 Vulnerable ·Microsoft
Remediation
- Fix · GHSA-w3x6-4m5h-cxqf System.Security.Cryptography.Xml (NuGet) Fixed in 10.0.6 Advisory →
- Fix · GHSA-w3x6-4m5h-cxqf System.Security.Cryptography.Xml (NuGet) Fixed in 9.0.15 Advisory →
- Fix · GHSA-w3x6-4m5h-cxqf System.Security.Cryptography.Xml (NuGet) Fixed in 8.0.3 Advisory →
Red Hat 17 advisories
- RHSA-2026:13693 Released 2026-05-05 · Red Hat rating Important.NET 8.0 security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) aspnetcore-runtime-8.0-8.0.26-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.26-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.26-1.el9_4 +11
- RHSA-2026:13282 Released 2026-05-04 · Red Hat rating Important.NET 9.0 security update
- Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-9.0-source-built-artifacts-9.0.116-1.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-9.0-9.0.15-1.el9_6, aspnetcore-runtime-dbg-9.0-9.0.15-1.el9_6, aspnetcore-targeting-pack-9.0-9.0.15-1.el9_6 +12
- RHSA-2026:13283 Released 2026-05-04 · Red Hat rating Important.NET 8.0 security update
- Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-8.0-8.0.26-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.26-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.26-1.el9_6 +9
Show 14 more Red Hat advisories
- RHSA-2026:13280 Released 2026-05-04 · Red Hat rating Important.NET 9.0 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-9.0-9.0.15-1.el10_0, aspnetcore-runtime-dbg-9.0-9.0.15-1.el10_0, aspnetcore-targeting-pack-9.0-9.0.15-1.el10_0 +12
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-9.0-source-built-artifacts-9.0.116-1.el10_0
- RHSA-2026:13281 Released 2026-05-04 · Red Hat rating Important.NET 8.0 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-8.0-8.0.26-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.26-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.26-1.el10_0 +9
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el10_0
- RHSA-2026:9205 Released 2026-04-21 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet9.0-9.0.116-1.hum1@src
- RHSA-2026:9080 Released 2026-04-20 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet8.0-8.0.126-1.hum1@src
- RHSA-2026:9077 Released 2026-04-20 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet10.0-10.0.106-1.hum1@src
- RHSA-2026:8474 Released 2026-04-16 · Red Hat rating Important.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-9.0-9.0.15-1.el9_7, aspnetcore-runtime-dbg-9.0-9.0.15-1.el9_7, aspnetcore-targeting-pack-9.0-9.0.15-1.el9_7 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-9.0-source-built-artifacts-9.0.116-1.el9_7
- RHSA-2026:8471 Released 2026-04-16 · Red Hat rating Important.NET 10.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-10.0-10.0.6-1.el9_7, aspnetcore-runtime-dbg-10.0-10.0.6-1.el9_7, aspnetcore-targeting-pack-10.0-10.0.6-1.el9_7 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-10.0-source-built-artifacts-10.0.106-1.el9_7
- RHSA-2026:8473 Released 2026-04-16 · Red Hat rating Important.NET 10.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-10.0-10.0.6-1.el8_10, aspnetcore-runtime-dbg-10.0-10.0.6-1.el8_10, aspnetcore-targeting-pack-10.0-10.0.6-1.el8_10 +12
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-10.0-source-built-artifacts-10.0.106-1.el8_10
- RHSA-2026:8475 Released 2026-04-16 · Red Hat rating Important.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-9.0-9.0.15-1.el8_10, aspnetcore-runtime-dbg-9.0-9.0.15-1.el8_10, aspnetcore-targeting-pack-9.0-9.0.15-1.el8_10 +11
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-9.0-source-built-artifacts-9.0.116-1.el8_10
- RHSA-2026:8469 Released 2026-04-16 · Red Hat rating Important.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.26-1.el9_7, aspnetcore-runtime-dbg-8.0-8.0.26-1.el9_7, aspnetcore-targeting-pack-8.0-8.0.26-1.el9_7 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el9_7
- RHSA-2026:8468 Released 2026-04-16 · Red Hat rating Important.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.26-1.el8_10, aspnetcore-runtime-dbg-8.0-8.0.26-1.el8_10, aspnetcore-targeting-pack-8.0-8.0.26-1.el8_10 +9
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el8_10
- RHSA-2026:8467 Released 2026-04-16 · Red Hat rating Important.NET 10.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-10.0-10.0.6-1.el10_1, aspnetcore-runtime-dbg-10.0-10.0.6-1.el10_1, aspnetcore-targeting-pack-10.0-10.0.6-1.el10_1 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-10.0-source-built-artifacts-10.0.106-1.el10_1
- RHSA-2026:8472 Released 2026-04-16 · Red Hat rating Important.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-9.0-9.0.15-1.el10_1, aspnetcore-runtime-dbg-9.0-9.0.15-1.el10_1, aspnetcore-targeting-pack-9.0-9.0.15-1.el10_1 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-9.0-source-built-artifacts-9.0.116-1.el10_1
- RHSA-2026:8470 Released 2026-04-16 · Red Hat rating Important.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.26-1.el10_1, aspnetcore-runtime-dbg-8.0-8.0.26-1.el10_1, aspnetcore-targeting-pack-8.0-8.0.26-1.el10_1 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el10_1
Microsoft 3 updates
- Security Update
- .NET 9.0 installed on Linux 9.0.15
- .NET 9.0 installed on Mac OS 9.0.15
- .NET 9.0 installed on Windows 9.0.15
- Security Update
- .NET 8.0 8.0.26
- .NET 8.0 installed on Linux 8.0.26
- .NET 8.0 installed on Mac OS 8.0.26
- .NET 8.0 installed on Windows 8.0.26
- Security Update
- .NET 10.0 installed on Linux 10.0.6
- .NET 10.0 installed on Mac OS 10.0.6
- .NET 10.0 installed on Windows 10.0.6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Fixed | RHSA-2026:13693 |
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Fixed | RHSA-2026:13282, RHSA-2026:13283 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:8467, RHSA-2026:8470, RHSA-2026:8472 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:8468, RHSA-2026:8473, RHSA-2026:8475 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:8469, RHSA-2026:8471, RHSA-2026:8474 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:13280, RHSA-2026:13281 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:13693 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:13282, RHSA-2026:13283 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:8468, RHSA-2026:8473, RHSA-2026:8475 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:8467, RHSA-2026:8470, RHSA-2026:8472 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:8469, RHSA-2026:8471, RHSA-2026:8474 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:13280, RHSA-2026:13281 |
| Red Hat Hardened Images | Fixed | RHSA-2026:9077, RHSA-2026:9080, RHSA-2026:9205 |
Not affected: 1 product
- Red Hat Hardened Images
Microsoft
Microsoft's page for this CVE →
- Impact
- Denial of Service
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| PowerShell 7.5 | Fixed | 7.5.6 · Security Update |
| PowerShell 7.6 | Fixed | 7.6.1 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-26171
- 2026-10-03 Alias added: GHSA-w3x6-4m5h-cxqf
References
More Microsoft .net vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-26171 · CVE Program
- CVE-2026-26171 · NVD
- FIRST EPSS
- GHSA-w3x6-4m5h-cxqf · GitHub Advisory Database · CC BY 4.0
- CVE-2026-26171 · Microsoft Security Update Guide
- CVE-2026-26171 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences