Vulnerability · Published Jul 14, 2026 · Assigned by microsoft

CVE-2026-50659.NET Spoofing Vulnerability

Medium 6.5

In plain English

A medium-severity security flaw in Microsoft .NET Framework 3.5 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.7%top 45.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10aspnetcore-runtime-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8aspnetcore-runtime-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9aspnetcore-runtime-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10aspnetcore-runtime-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8aspnetcore-runtime-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9aspnetcore-runtime-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10aspnetcore-runtime-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8aspnetcore-runtime-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9aspnetcore-runtime-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10aspnetcore-runtime-dbg-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8aspnetcore-runtime-dbg-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9aspnetcore-runtime-dbg-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10aspnetcore-runtime-dbg-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8aspnetcore-runtime-dbg-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9aspnetcore-runtime-dbg-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10aspnetcore-runtime-dbg-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8aspnetcore-runtime-dbg-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9aspnetcore-runtime-dbg-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10aspnetcore-targeting-pack-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8aspnetcore-targeting-pack-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9aspnetcore-targeting-pack-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10aspnetcore-targeting-pack-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8aspnetcore-targeting-pack-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9aspnetcore-targeting-pack-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10aspnetcore-targeting-pack-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8aspnetcore-targeting-pack-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9aspnetcore-targeting-pack-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:8dotnet10.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:10dotnet-apphost-pack-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-apphost-pack-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-apphost-pack-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-apphost-pack-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-apphost-pack-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-apphost-pack-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-apphost-pack-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-apphost-pack-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-apphost-pack-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-host10.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-host10.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-host10.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-hostfxr-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-hostfxr-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-hostfxr-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-hostfxr-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-hostfxr-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-hostfxr-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-hostfxr-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-hostfxr-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-hostfxr-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-runtime-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-runtime-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-runtime-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-runtime-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-runtime-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-runtime-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-runtime-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-runtime-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-runtime-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-runtime-dbg-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-runtime-dbg-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-runtime-dbg-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-runtime-dbg-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-runtime-dbg-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-runtime-dbg-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-runtime-dbg-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-runtime-dbg-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-runtime-dbg-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-10.0-source-built-artifacts10.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-10.0-source-built-artifacts10.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-10.0-source-built-artifacts10.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-8.08.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-sdk-8.08.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-sdk-8.08.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-sdk-8.0-source-built-artifacts8.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-sdk-8.0-source-built-artifacts8.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-sdk-8.0-source-built-artifacts8.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-sdk-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-9.0-source-built-artifacts9.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-9.0-source-built-artifacts9.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-9.0-source-built-artifacts9.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-aot-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-aot-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-aot-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-aot-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-aot-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-aot-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-dbg-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-dbg-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-dbg-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-dbg-8.08.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-sdk-dbg-8.08.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-sdk-dbg-8.08.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-sdk-dbg-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-dbg-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-dbg-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-targeting-pack-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-targeting-pack-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-targeting-pack-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-targeting-pack-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-targeting-pack-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-targeting-pack-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-targeting-pack-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-targeting-pack-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-targeting-pack-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-templates-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-templates-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-templates-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-templates-8.08.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-templates-8.08.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-templates-8.08.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-templates-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-templates-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-templates-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10netstandard-targeting-pack-2.19.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8netstandard-targeting-pack-2.19.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9netstandard-targeting-pack-2.19.0.119-1.el9_8ALSA-2026:41896
Alpine:v3.23dotnet10-runtime10.0.10-r0ALPINE-CVE-2026-50659
Alpine:v3.24dotnet10-runtime10.0.10-r0ALPINE-CVE-2026-50659
Alpine:v3.22dotnet8-runtime8.0.29-r0ALPINE-CVE-2026-50659
Alpine:v3.23dotnet8-runtime8.0.29-r0ALPINE-CVE-2026-50659
Alpine:v3.24dotnet8-runtime8.0.29-r0ALPINE-CVE-2026-50659
Alpine:v3.22dotnet9-runtime9.0.18-r0ALPINE-CVE-2026-50659
Alpine:v3.23dotnet9-runtime9.0.18-r0ALPINE-CVE-2026-50659
Alpine:v3.24dotnet9-runtime9.0.18-r0ALPINE-CVE-2026-50659
NuGetmicrosoft.netcore.app.runtime.linux-arm9.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-arm8.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-arm10.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-arm6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-arm649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-arm648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm8.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm9.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm10.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-x6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-x648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-musl-x649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-x648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-x649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.linux-x6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.osx-arm6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.osx-arm648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.osx-arm649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.osx-x6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.osx-x648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.osx-x649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-arm10.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-arm8.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-arm9.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-arm649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-arm6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-arm648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-x648.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-x649.0.18GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-x6410.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-x868.0.29GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-x8610.0.10GHSA-74jp-vm22-8q8x
NuGetmicrosoft.netcore.app.runtime.win-x869.0.18GHSA-74jp-vm22-8q8x
Rocky Linux:10dotnet10.00:10.0.110-1.el10_2RLSA-2026:41897
Rocky Linux:8dotnet10.00:10.0.110-1.el8_10RLSA-2026:41900
Rocky Linux:9dotnet10.00:10.0.110-1.el9_8RLSA-2026:41898
Rocky Linux:10dotnet8.00:8.0.129-1.el10_2RLSA-2026:41893
Rocky Linux:8dotnet8.00:8.0.129-1.el8_10RLSA-2026:41901
Rocky Linux:9dotnet8.00:8.0.129-1.el9_8RLSA-2026:41894
Rocky Linux:10dotnet9.00:9.0.119-1.el10_2RLSA-2026:41895
Rocky Linux:8dotnet9.00:9.0.119-1.el8_10RLSA-2026:41899
Rocky Linux:9dotnet9.00:9.0.119-1.el9_8RLSA-2026:41896
Ubuntu:24.04:LTSdotnet1010.0.110-10.0.10-0ubuntu1~24.04.1UBUNTU-CVE-2026-50659
Ubuntu:26.04:LTSdotnet1010.0.110-10.0.10-0ubuntu1~26.04.1UBUNTU-CVE-2026-50659
Ubuntu:22.04:LTSdotnet6no fix listedUBUNTU-CVE-2026-50659
Ubuntu:22.04:LTSdotnet7no fix listedUBUNTU-CVE-2026-50659
Ubuntu:22.04:LTSdotnet88.0.129-8.0.29-0ubuntu1~22.04.1UBUNTU-CVE-2026-50659
Ubuntu:24.04:LTSdotnet88.0.129-8.0.29-0ubuntu1~24.04.1UBUNTU-CVE-2026-50659

Affected products (as reported)

VendorProductVersions
Microsoft .NET 10.0 runtime 10.0.0 – before 10.0.10
Microsoft .NET 8.0 runtime 8.0.0 – before 8.0.29
Microsoft .NET 9.0 runtime 9.0.0 – before 9.0.18
Microsoft Microsoft .NET Framework 3.5 3.5.0 – before 2.0.50727.8983 & 3.0.30729.8978
Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 – before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
Microsoft Microsoft .NET Framework 3.5 AND 4.8 4.8.0 – before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 – before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 – before 4.7.4143.0
Microsoft Microsoft .NET Framework 4.8 4.8.0 – before 4.8.4803.0
Microsoft Microsoft .NET Framework 4.8.1 4.8.0.0 – before 4.8.9340.0
Microsoft Microsoft Visual Studio 2022 version 17.12 17.12.0 – before 17.12.22
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – before 17.14.36
Microsoft Microsoft Visual Studio 2026 version 18.7 18.0 – before 18.7.4

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

References