Is CVE-2026-42899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42899 being exploited in the wild.

How severe is CVE-2026-42899?

High severity, with a CVSS score of 7.5, published 12 May 2026.

How is CVE-2026-42899 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42899?

Check whether you run Apple macOS, Linux Kernel, Microsoft Asp.Net Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service

CVE-2026-42899 · Severity: high · CVSS 7.5 · Published 2026-05-12

A vulnerability exists in ASP.NET Core, a popular framework used for building web applications and services. An unauthorized attacker can send a specially crafted request that triggers an infinite loop within the application, causing it to stop responding to legitimate users. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and customer access to web services.

Quick answers

Is CVE-2026-42899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42899 being exploited in the wild.
How severe is CVE-2026-42899?: High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?: Microsoft Asp.Net Core 8.0, 9.0, 10.0, 8.0.0-8.0.26, 9.0.0-9.0.15, 10.0.0-10.0.7; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.27; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.27; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.27; and 9 more.
Is there a fix for CVE-2026-42899?: Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.27 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42899 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42899?: Check whether you run Apple macOS, Linux Kernel, Microsoft Asp.Net Core or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm --version 8.0.27

Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 8.0.27

Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.27 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 8.0.27

Technical details

A 'Loop with Unreachable Exit Condition' (CWE-835) exists in ASP.NET Core and the .NET runtime. The flaw allows an unauthenticated attacker to trigger an infinite loop via a network request, leading to 100% CPU utilization and a complete denial of service for the affected application. The vulnerability impacts .NET versions 8.0, 9.0, and 10.0. Security updates have been released by Microsoft and redistributed by vendors like Red Hat to address the issue by ensuring loop exit conditions are reachable.

Affected products

Microsoft ASP.NET Core 8.0, 9.0, 10.0
Microsoft .NET 8.0, 9.0, 10.0
Red Hat Red Hat Enterprise Linux 8, 9, 10

Identifiers

CVE-2026-42899
GHSA-9v76-4qcc-frgh

Timeline

2026-05-12: disclosed
2026-05-14: patched: Red Hat released initial security advisories (RHSA-2026:17464)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.