Junglewise Threat Intelligence

CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service

CVE-2026-42899 · Severity: high · CVSS 7.5 · Published 2026-05-12

Executive brief

A vulnerability exists in ASP.NET Core, a popular framework used for building web applications and services. An unauthorized attacker can send a specially crafted request that triggers an infinite loop within the application, causing it to stop responding to legitimate users. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and customer access to web services.

Technical details

A 'Loop with Unreachable Exit Condition' (CWE-835) exists in ASP.NET Core and the .NET runtime. The flaw allows an unauthenticated attacker to trigger an infinite loop via a network request, leading to 100% CPU utilization and a complete denial of service for the affected application. The vulnerability impacts .NET versions 8.0, 9.0, and 10.0. Security updates have been released by Microsoft and redistributed by vendors like Red Hat to address the issue by ensuring loop exit conditions are reachable.

Affected products

  • Microsoft ASP.NET Core 8.0, 9.0, 10.0
  • Microsoft .NET 8.0, 9.0, 10.0
  • Red Hat Red Hat Enterprise Linux 8, 9, 10

Timeline

  • 2026-05-12: disclosed
  • 2026-05-14: patched: Red Hat released initial security advisories (RHSA-2026:17464)

References

Related threats