Vulnerability · Published Aug 11, 2026 · Assigned by microsoft

CVE-2026-62901.NET Denial of Service Vulnerability

High 7.5

In plain English

A high-severity security flaw in Microsoft Visual Studio 2022 version 17.14 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.2%top 30.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10aspnetcore-runtime-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8aspnetcore-runtime-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9aspnetcore-runtime-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10aspnetcore-runtime-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8aspnetcore-runtime-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9aspnetcore-runtime-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10aspnetcore-runtime-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8aspnetcore-runtime-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9aspnetcore-runtime-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:10aspnetcore-runtime-dbg-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8aspnetcore-runtime-dbg-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9aspnetcore-runtime-dbg-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10aspnetcore-runtime-dbg-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8aspnetcore-runtime-dbg-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9aspnetcore-runtime-dbg-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10aspnetcore-runtime-dbg-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8aspnetcore-runtime-dbg-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9aspnetcore-runtime-dbg-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:10aspnetcore-targeting-pack-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8aspnetcore-targeting-pack-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9aspnetcore-targeting-pack-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10aspnetcore-targeting-pack-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8aspnetcore-targeting-pack-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9aspnetcore-targeting-pack-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10aspnetcore-targeting-pack-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8aspnetcore-targeting-pack-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9aspnetcore-targeting-pack-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:8dotnet10.0.111-1.el8_10ALSA-2026:54542
AlmaLinux:10dotnet-apphost-pack-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-apphost-pack-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-apphost-pack-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-apphost-pack-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-apphost-pack-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-apphost-pack-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-apphost-pack-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-apphost-pack-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-apphost-pack-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-host10.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-host10.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-host10.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-hostfxr-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-hostfxr-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-hostfxr-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-hostfxr-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-hostfxr-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-hostfxr-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-hostfxr-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-hostfxr-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-hostfxr-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-runtime-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-runtime-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-runtime-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-runtime-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-runtime-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-runtime-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-runtime-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-runtime-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-runtime-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-runtime-dbg-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-runtime-dbg-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-runtime-dbg-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-runtime-dbg-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-runtime-dbg-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-runtime-dbg-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-runtime-dbg-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-runtime-dbg-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-runtime-dbg-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-sdk-10.010.0.111-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-sdk-10.010.0.111-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-sdk-10.010.0.111-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-sdk-10.0-source-built-artifacts10.0.111-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-sdk-10.0-source-built-artifacts10.0.111-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-sdk-10.0-source-built-artifacts10.0.111-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-sdk-8.08.0.130-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-sdk-8.08.0.130-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-sdk-8.08.0.130-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-sdk-8.0-source-built-artifacts8.0.130-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-sdk-8.0-source-built-artifacts8.0.130-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-sdk-8.0-source-built-artifacts8.0.130-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-sdk-9.09.0.120-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-sdk-9.09.0.120-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-sdk-9.09.0.120-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-sdk-9.0-source-built-artifacts9.0.120-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-sdk-9.0-source-built-artifacts9.0.120-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-sdk-9.0-source-built-artifacts9.0.120-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-sdk-aot-10.010.0.111-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-sdk-aot-10.010.0.111-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-sdk-aot-10.010.0.111-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-sdk-aot-9.09.0.120-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-sdk-aot-9.09.0.120-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-sdk-aot-9.09.0.120-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-sdk-dbg-10.010.0.111-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-sdk-dbg-10.010.0.111-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-sdk-dbg-10.010.0.111-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-sdk-dbg-8.08.0.130-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-sdk-dbg-8.08.0.130-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-sdk-dbg-8.08.0.130-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-sdk-dbg-9.09.0.120-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-sdk-dbg-9.09.0.120-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-sdk-dbg-9.09.0.120-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-targeting-pack-10.010.0.11-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-targeting-pack-10.010.0.11-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-targeting-pack-10.010.0.11-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-targeting-pack-8.08.0.30-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-targeting-pack-8.08.0.30-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-targeting-pack-8.08.0.30-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-targeting-pack-9.09.0.19-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-targeting-pack-9.09.0.19-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-targeting-pack-9.09.0.19-1.el9_8ALSA-2026:55856
AlmaLinux:10dotnet-templates-10.010.0.111-1.el10_2ALSA-2026:55858
AlmaLinux:8dotnet-templates-10.010.0.111-1.el8_10ALSA-2026:54542
AlmaLinux:9dotnet-templates-10.010.0.111-1.el9_8ALSA-2026:55857
AlmaLinux:10dotnet-templates-8.08.0.130-1.el10_2ALSA-2026:54541
AlmaLinux:8dotnet-templates-8.08.0.130-1.el8_10ALSA-2026:54538
AlmaLinux:9dotnet-templates-8.08.0.130-1.el9_8ALSA-2026:54574
AlmaLinux:10dotnet-templates-9.09.0.120-1.el10_2ALSA-2026:54590
AlmaLinux:8dotnet-templates-9.09.0.120-1.el8_10ALSA-2026:54550
AlmaLinux:9dotnet-templates-9.09.0.120-1.el9_8ALSA-2026:55856
AlmaLinux:10netstandard-targeting-pack-2.19.0.120-1.el10_2ALSA-2026:54590
AlmaLinux:8netstandard-targeting-pack-2.19.0.120-1.el8_10ALSA-2026:54550
AlmaLinux:9netstandard-targeting-pack-2.19.0.120-1.el9_8ALSA-2026:55856
Alpine:v3.23dotnet10-runtime10.0.13-r0ALPINE-CVE-2026-62901
Alpine:v3.24dotnet10-runtime10.0.12-r0ALPINE-CVE-2026-62901
Alpine:v3.22dotnet8-runtime8.0.31-r0ALPINE-CVE-2026-62901
Alpine:v3.23dotnet8-runtime8.0.31-r0ALPINE-CVE-2026-62901
Alpine:v3.24dotnet8-runtime8.0.31-r0ALPINE-CVE-2026-62901
Alpine:v3.22dotnet9-runtime9.0.20-r0ALPINE-CVE-2026-62901
Alpine:v3.23dotnet9-runtime9.0.20-r0ALPINE-CVE-2026-62901
Alpine:v3.24dotnet9-runtime9.0.20-r0ALPINE-CVE-2026-62901
NuGetmicrosoft.netcore.app.runtime.linux-arm10.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-arm9.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-arm8.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-arm648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-arm6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-arm649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm10.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm8.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm9.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-x648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-x649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-musl-x6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-x648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-x649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.linux-x6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.osx-arm649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.osx-arm6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.osx-arm648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.osx-x648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.osx-x649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.osx-x6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-arm649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-arm6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-arm648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-x648.0.30GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-x649.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-x6410.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-x8610.0.11GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-x869.0.19GHSA-m93f-wj8c-rp8p
NuGetmicrosoft.netcore.app.runtime.win-x868.0.30GHSA-m93f-wj8c-rp8p
Rocky Linux:10dotnet10.00:10.0.111-1.el10_2RLSA-2026:55858
Rocky Linux:8dotnet10.00:10.0.111-1.el8_10RLSA-2026:54542
Rocky Linux:9dotnet10.00:10.0.111-1.el9_8RLSA-2026:55857
Rocky Linux:10dotnet8.00:8.0.130-1.el10_2RLSA-2026:54541
Rocky Linux:8dotnet8.00:8.0.130-1.el8_10RLSA-2026:54538
Rocky Linux:9dotnet8.00:8.0.130-1.el9_8RLSA-2026:54574
Rocky Linux:10dotnet9.00:9.0.120-1.el10_2RLSA-2026:54590
Rocky Linux:8dotnet9.00:9.0.120-1.el8_10RLSA-2026:54550
Rocky Linux:9dotnet9.00:9.0.120-1.el9_8RLSA-2026:55856
Ubuntu:24.04:LTSdotnet1010.0.111-10.0.11-0ubuntu1~24.04.1USN-8641-1
Ubuntu:24.04:LTSdotnet1010.0.111-10.0.11-0ubuntu1~24.04.1UBUNTU-CVE-2026-62901
Ubuntu:26.04:LTSdotnet1010.0.111-10.0.11-0ubuntu1~26.04.1USN-8641-1
Ubuntu:26.04:LTSdotnet1010.0.111-10.0.11-0ubuntu1~26.04.1UBUNTU-CVE-2026-62901
Ubuntu:22.04:LTSdotnet6no fix listedUBUNTU-CVE-2026-62901
Ubuntu:22.04:LTSdotnet7no fix listedUBUNTU-CVE-2026-62901
Ubuntu:22.04:LTSdotnet88.0.130-8.0.30-0ubuntu1~22.04.1USN-8641-1
Ubuntu:22.04:LTSdotnet88.0.130-8.0.30-0ubuntu1~22.04.1UBUNTU-CVE-2026-62901
Ubuntu:24.04:LTSdotnet88.0.130-8.0.30-0ubuntu1~24.04.1UBUNTU-CVE-2026-62901
Ubuntu:24.04:LTSdotnet88.0.130-8.0.30-0ubuntu1~24.04.1USN-8641-1

Affected products (as reported)

VendorProductVersions
Microsoft .NET 10.0 runtime 10.0.0 – before 10.0.11
Microsoft .NET 8.0 runtime 8.0.0 – before 8.0.30
Microsoft .NET 9.0 runtime 9.0.0 – before 9.0.19
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – before 17.14.38
Microsoft Microsoft Visual Studio 2026 version 18.8 18.0 – before 18.8.3

Weakness: CWE-606 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References