7.5High

CVE-2026-42899ASP.NET Core Denial of Service Vulnerability

Microsoft .NET 10.0; Microsoft .NET 8.0; Microsoft .NET 9.0; Red Hat Red Hat Enterprise Linux 10 Published: 2026-05-12 19:59 (6 months ago)

Description

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Weakness (CWE): CWE-835

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
microsoft	.net	8.0.0 – < 8.0.27
Microsoft	.NET 10.0	10.0.0 – < 10.0.8
Microsoft	.NET 8.0	8.0.0 – < 8.0.27
Microsoft	.NET 9.0	9.0.0 – < 9.0.16
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	all versions
Red Hat	Red Hat Hardened Images	all versions

References and patches

CPE matches (NVD) (3)

cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.0.27
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.16
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* ≥ 10.0.0 < 10.0.8

CVSS score

7.5High

Source: microsoft · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

All scores (4)

cna	CVSS 3.1	7.5High
redhat-SADP	CVSS 3.1	7.5High
secure@microsoft.com	CVSS 3.1	7.5High
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

2.43%

higher than 84% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-04-30
Published2026-05-12 19:59
Reached IP-DB2026-10-24 23:48
Last updated2026-10-26 21:10

Assigned by (CNA): microsoft
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — .NET

5.3Medium

CVE-2026-120796 yesterday

.NET Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft System.Text.Json

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

1.2%EPSS

7.5High

CVE-2026-118749 yesterday

ASP.NET Core Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft Microsoft Visual Studio 2026 version 18.12

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

1.1%EPSS

7.5High

CVE-2026-118748 yesterday

ASP.NET Core Denial of Service Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS; Microsoft .NET 11.0 installed on Windows; Microsoft Microsoft Visual Studio 2026 version 18.12

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

1.1%EPSS

8.8High

CVE-2026-118745 yesterday

Visual Studio Remote Code Execution Vulnerability

Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Windows; Microsoft .NET 8.0 installed on Windows; Microsoft .NET 9.0 installed on Windows

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

6.8Medium

CVE-2026-118746 yesterday

.NET Security Feature Bypass Vulnerability

Microsoft .NET 11.0 installed on Linux; Microsoft .NET 11.0 installed on Mac OS

Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.

8.8High

CVE-2026-114159 yesterday

Visual Studio Remote Code Execution Vulnerability

Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Windows; Microsoft .NET 8.0 installed on Windows; Microsoft .NET 9.0 installed on Windows

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.