Description
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.
The update addresses the vulnerability by correcting how the .NET web application handles web requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2022 version 17.14 | 17.14.0 – < 17.14.42 | 17.14.42 |
| Microsoft | Microsoft Visual Studio 2026 version 18.10 | 18.10.0 – < 18.10.4 | 18.10.4 |
| Microsoft | System.Security.Cryptography.Pkcs | 10.0.0 – < 10.0.13 | 10.0.13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | dotnet7 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | dotnet-hostfxr-8.0 +7 | 8.0.32-0.1.hum1 | RHSA-2026:84693 |
| Red Hat Hardened Images 1 | dotnet8.0 +4 | 8.0.132-0.1.hum1 | RHSA-2026:84693 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | dotnet10-runtime | 10.0.13-r0 | — |
| Alpine v3.24 | dotnet8-runtime | 8.0.32-r0 | — |
| Alpine v3.24 | dotnet9-runtime | 9.0.21-r0 | — |
| Alpine v3.23 | dotnet10-runtime | 10.0.13-r0 | — |
| Alpine v3.23 | dotnet8-runtime | 8.0.32-r0 | — |
| Alpine v3.23 | dotnet9-runtime | 9.0.21-r0 | — |
| Alpine v3.22 | dotnet8-runtime | 8.0.32-r0 | — |
| Alpine v3.22 | dotnet9-runtime | 9.0.21-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | dotnet-10-sdk | 10.0.113-r1 | — |
| Wolfi rolling | dotnet-8-sdk | 8.0.132-r0 | — |
| Wolfi rolling | dotnet-9-sdk | 9.0.122-r0 | — |
| Wolfi rolling | dotnet-bootstrap-8 | 8.0.134-r0 | — |
| Wolfi rolling | dotnet-bootstrap-9 | 9.0.124-r0 | — |
| Wolfi rolling | dotnet-sdk-10.0.2 | 10.0.204-r9 | — |
| Wolfi rolling | dotnet-sdk-10.0.3 | 10.0.303-r7 | — |
| Wolfi rolling | dotnet-sdk-10.0.4 | 10.0.402-r0 | — |
| Wolfi rolling | dotnet-sdk-stage0-10 | 10.0.113-r0 | — |
| Wolfi rolling | ilspycmd | 11.1-r1 | — |
| Wolfi rolling | promitor | 2.16.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | System.Security.Cryptography.Pkcs | >= 10.0.0, < 10.0.13 | 10.0.13 | GHSA-2fmv-rv2c-59x7 |
| NuGet | System.Security.Cryptography.Pkcs | >= 11.0.0-preview.1, < 11.0.0-rc.2 | 11.0.0-rc.2 | GHSA-2fmv-rv2c-59x7 |
| NuGet | System.Security.Cryptography.Pkcs | >= 8.0.0, < 8.0.2 | 8.0.2 | GHSA-2fmv-rv2c-59x7 |
| NuGet | System.Security.Cryptography.Pkcs | >= 9.0.0, < 9.0.21 | 9.0.21 | GHSA-2fmv-rv2c-59x7 |
Advisories 3
- RHSA-2026:84693 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3893 Microsoft Entwicklerwerkzeuge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
- MSRC-CVE-2026-70162 .NET Denial of Service Vulnerability Microsoft Security Response Center · Oct 16, 2026
References
- .NET Denial of Service Vulnerability vendor-advisory patch