Read the docs
TI-2026-72242 Aliases CVE-2026-70162GHSA-2fmv-rv2c-59x7

Denial of service in .NET web applications from crafted requests

Priority LOW 28CWE-405Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Microsoft Visual Studio 2022 version 17.14 from 17.14.0 before 17.14.42, Microsoft Visual Studio 2026 version 18.10 from 18.10.0 before 18.10.4, and the System.Security.Cryptography.Pkcs NuGet package from 8.0.0 before 8.0.2, from 9.0.0 before 9.0.21, from 10.0.0 before 10.0.13 and from 11.0.0-preview.1 before 11.0.0-rc.2 are affected. Improper handling of web requests in Microsoft Common Object Runtime Library causes asymmetric resource consumption (CWE-405). A remote unauthenticated attacker can send specially crafted requests to a .NET web application to cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00895 59th percentileScored 2026-11-07
Fix Fixed Microsoft Visual Studio 2022 version 17.14 (Microsoft): 17.14.42Microsoft Visual Studio 2026 version 18.10 (Microsoft): 18.10.4+2 more productsRed Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Visual Studio 2022 version 17.1417.14.0 to before 17.14.4217.14.42Patch availableCNA
MicrosoftMicrosoft Visual Studio 2026 version 18.1018.10.0 to before 18.10.418.10.4Patch availableCNA
MicrosoftSystem.Security.Cryptography.Pkcs10.0.0 to before 10.0.1310.0.13Patch availableCNA
—System.Security.Cryptography.Pkcs (NuGet)10.0.0 to before 10.0.1310.0.13Patch availableGHSA-2fmv-rv2c-59x7
—System.Security.Cryptography.Pkcs (NuGet)11.0.0-preview.1 to before 11.0.0-rc.211.0.0-rc.2Patch availableGHSA-2fmv-rv2c-59x7
—System.Security.Cryptography.Pkcs (NuGet)8.0.0 to before 8.0.28.0.2Patch availableGHSA-2fmv-rv2c-59x7
—System.Security.Cryptography.Pkcs (NuGet)9.0.0 to before 9.0.219.0.21Patch availableGHSA-2fmv-rv2c-59x7
  • Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.42 Fixed in 17.14.42 Patch available CNA
  • Microsoft Visual Studio 2026 version 18.10 VendorMicrosoft Affected 18.10.0 to before 18.10.4 Fixed in 18.10.4 Patch available CNA
  • System.Security.Cryptography.Pkcs VendorMicrosoft Affected 10.0.0 to before 10.0.13 Fixed in 10.0.13 Patch available CNA
  • System.Security.Cryptography.Pkcs (NuGet) Vendor— Affected 10.0.0 to before 10.0.13 Fixed in 10.0.13 Patch available GHSA-2fmv-rv2c-59x7
  • System.Security.Cryptography.Pkcs (NuGet) Vendor— Affected 11.0.0-preview.1 to before 11.0.0-rc.2 Fixed in 11.0.0-rc.2 Patch available GHSA-2fmv-rv2c-59x7
  • System.Security.Cryptography.Pkcs (NuGet) Vendor— Affected 8.0.0 to before 8.0.2 Fixed in 8.0.2 Patch available GHSA-2fmv-rv2c-59x7
  • System.Security.Cryptography.Pkcs (NuGet) Vendor— Affected 9.0.0 to before 9.0.21 Fixed in 9.0.21 Patch available GHSA-2fmv-rv2c-59x7

Remediation

Update Visual Studio 2022 version 17.14 to 17.14.42, Visual Studio 2026 version 18.10 to 18.10.4, and System.Security.Cryptography.Pkcs to 8.0.2, 9.0.21, 10.0.13 or 11.0.0-rc.2 for the matching release line. Red Hat fixes Red Hat Hardened Images in RHSA-2026:84693.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA Microsoft Visual Studio 2022 version 17.14 (Microsoft) Fixed in 17.14.42
  • Fix · CNA Microsoft Visual Studio 2026 version 18.10 (Microsoft) Fixed in 18.10.4
  • Fix · CNA System.Security.Cryptography.Pkcs (Microsoft) Fixed in 10.0.13
  • Fix · GHSA-2fmv-rv2c-59x7 System.Security.Cryptography.Pkcs (NuGet) Fixed in 10.0.13 Advisory →
  • Fix · GHSA-2fmv-rv2c-59x7 System.Security.Cryptography.Pkcs (NuGet) Fixed in 11.0.0-rc.2 Advisory →
  • Fix · GHSA-2fmv-rv2c-59x7 System.Security.Cryptography.Pkcs (NuGet) Fixed in 8.0.2 Advisory →
  • Fix · GHSA-2fmv-rv2c-59x7 System.Security.Cryptography.Pkcs (NuGet) Fixed in 9.0.21 Advisory →

Red Hat 1 advisory

  • RHSA-2026:84693 Released 2026-10-19 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images aspnetcore-runtime-8.0-8.0.32-0.1.hum1@aarch64, aspnetcore-runtime-8.0-8.0.32-0.1.hum1@x86_64, aspnetcore-runtime-dbg-8.0-8.0.32-0.1.hum1@aarch64 +22

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:84693

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-70162
  2. 2026-10-13 Alias added: GHSA-2fmv-rv2c-59x7
  3. 2026-10-13 Fix available: NuGet/[email protected], NuGet/[email protected], NuGet/[email protected] +1 · GHSA-2fmv-rv2c-59x7
  4. 2026-10-13 CVSS score added · GHSA-2fmv-rv2c-59x7
  5. 2026-10-13 Weakness changed · GHSA-2fmv-rv2c-59x7
  6. 2026-10-13 4 new references · GHSA-2fmv-rv2c-59x7
  7. 2026-10-13 CISA SSVC decision points changed
  8. 2026-10-14 Priority changed: MEDIUM → LOW
  9. 2026-10-20 2 new references · GHSA-2fmv-rv2c-59x7
  10. 2026-10-21 Fix available: RHSA-2026:84693 · Red Hat
  11. 2026-10-21 Fix available: Red Hat Hardened Images · Red Hat
  12. 2026-10-21 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 4

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences