VDB

CVE-2026-26171

CVE-2026-26171 PUBLISHED CVSS 7.5 HIGH

.NET Denial of Service Vulnerability

Reported by microsoft · Published April 14, 2026

Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
dotnet-hosterrata.rockylinux.org0:10.0.6-1.el9_7.x86_64, 0:10.0.6-1.el9_7.aarch64, 0:10.0.6-1.el10_1.ppc64le
aspnetcore-targeting-pack-9.0errata.rockylinux.org0:9.0.15-1.el9_7.s390x, 0:9.0.15-1.el8_10.x86_64, 0:9.0.15-1.el8_10.aarch64
dotnet-targeting-pack-10.0errata.rockylinux.org0:10.0.6-1.el9_7.ppc64le, 0:10.0.6-1.el10_1.ppc64le
dotnet-runtime-10.0errata.rockylinux.org0:10.0.6-1.el8_10.x86_64
dotnet-runtime-dbg-9.0errata.rockylinux.org0:9.0.15-1.el8_10.x86_64
dotnet-sdk-dbg-8.0Amazon Linux8.0.126-1.amzn2023.0.1
dotnet-hostfxr-9.0errata.rockylinux.org0:9.0.15-1.el9_7.x86_64, 0:9.0.15-1.el10_1.x86_64
dotnet-sdk-9.0-debuginfoerrata.rockylinux.org0:9.0.116-1.el9_7.aarch64, 0:9.0.116-1.el8_10.x86_64, 0:9.0.116-1.el8_10.aarch64, 0:9.0.116-1.el10_1.ppc64le
dotnet-templates-10.0errata.rockylinux.org0:10.0.106-1.el9_7.ppc64le, 0:10.0.106-1.el10_1.aarch64
dotnet9.0errata.rockylinux.org0:9.0.116-1.el9_7.src, 0:9.0.116-1.el10_1.src
dotnet10.0-debugsourceerrata.rockylinux.org0:10.0.106-1.el9_7.s390x, 0:10.0.106-1.el10_1.s390x, 0:10.0.106-1.el10_1.ppc64le
dotnet-apphost-pack-10.0-debuginfoerrata.rockylinux.org0:10.0.6-1.el8_10.x86_64, 0:10.0.6-1.el8_10.aarch64, 0:10.0.6-1.el10_1.x86_64, 0:10.0.6-1.el10_1.s390x

34 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Affected products

VendorProductVersions
Microsoft.NET 10.010.0.0
Microsoft.NET 8.08.0.0
Microsoft.NET 9.09.0.0
MicrosoftPowerShell 7.57.5.0
MicrosoftPowerShell 7.67.6.0
amazon:2023dotnet-sdk-dbg-8.00
Red HatRed Hat Hardened Images10.0.106-1.hum1
Microsoft.NET 9.09.0.0
amazon:2023aspnetcore-runtime-9.00
amazon:2023dotnet-runtime-9.00
amazon:2023dotnet-sdk-8.00
wolfidotnet-sdk-stage0-100
amazon:2023dotnet-apphost-pack-10.00
Red HatRed Hat Enterprise Linux AppStream (v. 9)
Red HatRed Hat Enterprise Linux AppStream EUS (v.9.4)
alpinedotnet10-runtime0
Red HatRed Hat CodeReady Linux Builder EUS (v.9.4)
wolfidotnet-sdk-10.0.20
chainguarddotnet-100
Red HatRed Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)

…and 87 more

Timeline

  • Apr 14, 2026 CVE Published
  • Apr 14, 2026 PoC Published (2 in total, the first dated here)
  • Apr 15, 2026 Security Advisory (23 in total, the first dated here)
  • Apr 17, 2026 Distribution Patch (28 in total, the first dated here)
  • May 3, 2026 CVE Updated
  • May 18, 2026 EPSS Score (30 in total, the first dated here)
  • Jul 3, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-26171
vulnetix vdb fixes CVE-2026-26171

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-26171/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 6 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›