Vulnerability details
CVE-2026-42899
Microsoft NET
ASP.NET Core Denial of Service Vulnerability
CVSS 3.1
7.5High
Official description
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (microsoft) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Microsoft | .NET 10.0 | 10.0.0 ≤ v < 10.0.8 | CVEProject cvelistV5 (CNA) |
| Microsoft | .NET 8.0 | 8.0.0 ≤ v < 8.0.27 | CVEProject cvelistV5 (CNA) |
| Microsoft | .NET 9.0 | 9.0.0 ≤ v < 9.0.16 | CVEProject cvelistV5 (CNA) |
References and advisories
21- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899 vendor-advisorypatch
- https://access.redhat.com/security/cve/CVE-2026-42899 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2476605 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42899.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24332 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24333 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22145 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21286 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21754 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21295 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21291 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21294 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24334 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24335 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24336 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21297 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21293 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21296 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17464 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17682 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17527 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-12
- Last updated
- 2026-08-10
- State
- Published
- Assigner (CNA)
- microsoft
Exploit prediction (EPSS)
2.43%
Probability of exploitation in 30 days
84.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')