CVE-2026-26127 — .NET Denial of Service Vulnerability

Affected: Microsoft .NET 10.0, Microsoft .NET 9.0, Microsoft.Bcl.Memory

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

USN-8085-1 — dotnet8, dotnet9, dotnet10 vulnerabilities

Affected: Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9

It was discovered that the .NET Microsoft.Bcl.Memory NuGet package did not properly handle certain malformed Base64Url encoded input. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. This issue only affected .NET 9.0 and .NET 10.0. (CVE-2026-26127)

Bartłomiej Dach discovered that .NET's SignalR server component did not properly manage resource consumption when processing certain messages. An attacker could possibly use this issue to exhaust internal buffers, resulting in a denial of service. (CVE-2026-26130)

Most recent entries from all

CVE-2026-26127 — .NET Denial of Service Vulnerability

USN-8085-1 — dotnet8, dotnet9, dotnet10 vulnerabilities