VDB
CVE-2026-70162
CVE-2026-70162
PUBLISHED
CVSS 5.9 MEDIUM
Reported by microsoft · Published October 13, 2026
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.
Risk Scores
CVSS 3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Visual Studio 2022 version 17.14 | 17.14.0 |
| Microsoft | Microsoft Visual Studio 2026 version 18.10 | 18.10.0 |
| Microsoft | System.Security.Cryptography.Pkcs | 10.0.0 |
| wolfi | dotnet-8 | 0 |
| wolfi | dotnet-sdk-10.0.2 | 0 |
| wolfi | dotnet-sdk-10.0.3 | 0 |
| Microsoft | System.Security.Cryptography.Pkcs | 10.0.0 |
| wolfi | dotnet-10 | 0 |
| wolfi | dotnet-sdk-10.0.4 | 0 |
| alpine | dotnet9-runtime | 0 |
| alpine | dotnet10-runtime | 0 |
| wolfi | dotnet-sdk-stage0-10 | 0 |
| chainguard | dotnet-sdk-10.0.4 | 0 |
| Microsoft | Microsoft Visual Studio 2026 version 18.10 | 18.10.0 |
| chainguard | dotnet-sdk-stage0-10 | 0 |
| microsoft | visual_studio_2022 | 17.14.0 |
| wolfi | ilspycmd | 0 |
| chainguard | dotnet-9 | 0 |
| chainguard | actions-runner | 0 |
| chainguard | dotnet-sdk-10.0.2 | 0 |
…and 11 more
Timeline
- Oct 13, 2026 CVE Published
- Oct 14, 2026 EPSS Score
- Oct 14, 2026 Coalition ESS Score
- Oct 16, 2026 EPSS Score
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 26, 2026 CVE Updated
- Oct 27, 2026 Security Advisory
References
- .NET Denial of Service Vulnerability vendor-advisorypatch