Vulnerability · Published Jul 14, 2026 · Assigned by microsoft

CVE-2026-50651.NET Denial of Service Vulnerability

High 7.5

In plain English

A high-severity resource allocation without limits in Microsoft Visual Studio 2022 version 17.12 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.2%top 32.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10aspnetcore-runtime-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8aspnetcore-runtime-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9aspnetcore-runtime-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10aspnetcore-runtime-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8aspnetcore-runtime-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9aspnetcore-runtime-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10aspnetcore-runtime-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8aspnetcore-runtime-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9aspnetcore-runtime-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10aspnetcore-runtime-dbg-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8aspnetcore-runtime-dbg-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9aspnetcore-runtime-dbg-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10aspnetcore-runtime-dbg-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8aspnetcore-runtime-dbg-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9aspnetcore-runtime-dbg-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10aspnetcore-runtime-dbg-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8aspnetcore-runtime-dbg-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9aspnetcore-runtime-dbg-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10aspnetcore-targeting-pack-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8aspnetcore-targeting-pack-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9aspnetcore-targeting-pack-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10aspnetcore-targeting-pack-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8aspnetcore-targeting-pack-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9aspnetcore-targeting-pack-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10aspnetcore-targeting-pack-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8aspnetcore-targeting-pack-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9aspnetcore-targeting-pack-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:8dotnet10.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:10dotnet-apphost-pack-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-apphost-pack-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-apphost-pack-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-apphost-pack-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-apphost-pack-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-apphost-pack-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-apphost-pack-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-apphost-pack-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-apphost-pack-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-host10.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-host10.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-host10.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-hostfxr-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-hostfxr-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-hostfxr-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-hostfxr-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-hostfxr-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-hostfxr-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-hostfxr-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-hostfxr-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-hostfxr-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-runtime-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-runtime-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-runtime-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-runtime-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-runtime-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-runtime-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-runtime-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-runtime-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-runtime-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-runtime-dbg-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-runtime-dbg-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-runtime-dbg-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-runtime-dbg-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-runtime-dbg-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-runtime-dbg-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-runtime-dbg-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-runtime-dbg-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-runtime-dbg-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-10.0-source-built-artifacts10.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-10.0-source-built-artifacts10.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-10.0-source-built-artifacts10.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-8.08.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-sdk-8.08.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-sdk-8.08.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-sdk-8.0-source-built-artifacts8.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-sdk-8.0-source-built-artifacts8.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-sdk-8.0-source-built-artifacts8.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-sdk-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-9.0-source-built-artifacts9.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-9.0-source-built-artifacts9.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-9.0-source-built-artifacts9.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-aot-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-aot-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-aot-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-aot-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-aot-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-aot-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-sdk-dbg-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-sdk-dbg-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-sdk-dbg-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-sdk-dbg-8.08.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-sdk-dbg-8.08.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-sdk-dbg-8.08.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-sdk-dbg-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-sdk-dbg-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-sdk-dbg-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-targeting-pack-10.010.0.10-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-targeting-pack-10.010.0.10-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-targeting-pack-10.010.0.10-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-targeting-pack-8.08.0.29-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-targeting-pack-8.08.0.29-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-targeting-pack-8.08.0.29-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-targeting-pack-9.09.0.18-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-targeting-pack-9.09.0.18-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-targeting-pack-9.09.0.18-1.el9_8ALSA-2026:41896
AlmaLinux:10dotnet-templates-10.010.0.110-1.el10_2ALSA-2026:41897
AlmaLinux:8dotnet-templates-10.010.0.110-1.el8_10ALSA-2026:41900
AlmaLinux:9dotnet-templates-10.010.0.110-1.el9_8ALSA-2026:41898
AlmaLinux:10dotnet-templates-8.08.0.129-1.el10_2ALSA-2026:41893
AlmaLinux:8dotnet-templates-8.08.0.129-1.el8_10ALSA-2026:41901
AlmaLinux:9dotnet-templates-8.08.0.129-1.el9_8ALSA-2026:41894
AlmaLinux:10dotnet-templates-9.09.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8dotnet-templates-9.09.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9dotnet-templates-9.09.0.119-1.el9_8ALSA-2026:41896
AlmaLinux:10netstandard-targeting-pack-2.19.0.119-1.el10_2ALSA-2026:41895
AlmaLinux:8netstandard-targeting-pack-2.19.0.119-1.el8_10ALSA-2026:41899
AlmaLinux:9netstandard-targeting-pack-2.19.0.119-1.el9_8ALSA-2026:41896
Alpine:v3.23dotnet10-runtime10.0.10-r0ALPINE-CVE-2026-50651
Alpine:v3.24dotnet10-runtime10.0.10-r0ALPINE-CVE-2026-50651
Alpine:v3.22dotnet8-runtime8.0.29-r0ALPINE-CVE-2026-50651
Alpine:v3.23dotnet8-runtime8.0.29-r0ALPINE-CVE-2026-50651
Alpine:v3.24dotnet8-runtime8.0.29-r0ALPINE-CVE-2026-50651
Alpine:v3.22dotnet9-runtime9.0.18-r0ALPINE-CVE-2026-50651
Alpine:v3.23dotnet9-runtime9.0.18-r0ALPINE-CVE-2026-50651
Alpine:v3.24dotnet9-runtime9.0.18-r0ALPINE-CVE-2026-50651
NuGetmicrosoft.netcore.app.runtime.linux-arm9.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-arm8.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-arm10.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-arm6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-arm649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-arm648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm8.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm9.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm10.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-arm649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-x6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-x648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-musl-x649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-x648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-x649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.linux-x6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.osx-arm6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.osx-arm648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.osx-arm649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.osx-x6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.osx-x648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.osx-x649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-arm10.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-arm8.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-arm9.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-arm649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-arm6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-arm648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-x648.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-x649.0.18GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-x6410.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-x868.0.29GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-x8610.0.10GHSA-wp74-jgxh-gv4q
NuGetmicrosoft.netcore.app.runtime.win-x869.0.18GHSA-wp74-jgxh-gv4q
Rocky Linux:10dotnet10.00:10.0.110-1.el10_2RLSA-2026:41897
Rocky Linux:8dotnet10.00:10.0.110-1.el8_10RLSA-2026:41900
Rocky Linux:9dotnet10.00:10.0.110-1.el9_8RLSA-2026:41898
Rocky Linux:10dotnet8.00:8.0.129-1.el10_2RLSA-2026:41893
Rocky Linux:8dotnet8.00:8.0.129-1.el8_10RLSA-2026:41901
Rocky Linux:9dotnet8.00:8.0.129-1.el9_8RLSA-2026:41894
Rocky Linux:10dotnet9.00:9.0.119-1.el10_2RLSA-2026:41895
Rocky Linux:8dotnet9.00:9.0.119-1.el8_10RLSA-2026:41899
Rocky Linux:9dotnet9.00:9.0.119-1.el9_8RLSA-2026:41896
Ubuntu:24.04:LTSdotnet1010.0.110-10.0.10-0ubuntu1~24.04.1UBUNTU-CVE-2026-50651
Ubuntu:26.04:LTSdotnet1010.0.110-10.0.10-0ubuntu1~26.04.1UBUNTU-CVE-2026-50651
Ubuntu:22.04:LTSdotnet6no fix listedUBUNTU-CVE-2026-50651
Ubuntu:22.04:LTSdotnet7no fix listedUBUNTU-CVE-2026-50651
Ubuntu:22.04:LTSdotnet88.0.129-8.0.29-0ubuntu1~22.04.1UBUNTU-CVE-2026-50651
Ubuntu:24.04:LTSdotnet88.0.129-8.0.29-0ubuntu1~24.04.1UBUNTU-CVE-2026-50651

Affected products (as reported)

VendorProductVersions
Microsoft .NET 10.0 runtime 10.0.0 – before 10.0.10
Microsoft .NET 8.0 runtime 8.0.0 – before 8.0.29
Microsoft .NET 9.0 runtime 9.0.0 – before 9.0.18
Microsoft Microsoft Visual Studio 2022 version 17.12 17.12.0 – before 17.12.22
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – before 17.14.36
Microsoft Microsoft Visual Studio 2026 version 18.7 18.0 – before 18.7.4

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References