Executive brief
A security vulnerability has been identified in the Microsoft .NET runtime, which is used to build and run various software applications on Linux and macOS. An attacker could exploit this flaw by providing a specially crafted digital certificate, causing the application to crash or become unresponsive. This results in a denial of service, potentially disrupting business operations and service availability.
Technical details
A type confusion vulnerability (CWE-843) exists in the .NET runtime cryptography layer, specifically within the CryptoNative_GetX509NameInfo function. The issue affects .NET 8, 9, and 10 running on Linux and macOS across all architectures. An unauthenticated remote attacker can exploit this by submitting a specially crafted X.509 certificate for parsing, leading to a denial of service (DoS) condition. The vulnerability is resolved in .NET versions 8.0.29, 9.0.18, and 10.0.10. Developers must update their runtimes and redeploy any self-contained applications.
Affected products
- Microsoft .NET 10.0 >= 10.0.0, <= 10.0.9
- Microsoft .NET 9.0 >= 9.0.0, <= 9.0.17
- Microsoft .NET 8.0 >= 8.0.0, <= 8.0.28
Timeline
- 2026-07-14: advisory: Initial advisory publication
- 2026-07-20: other: Advisory updated
References
- https://github.com/dotnet/runtime/security/advisories/GHSA-rp2p-6cmp-jxj9
- https://github.com/dotnet/announcements/issues/408
- https://github.com/dotnet/runtime/issues/130707
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108
- https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-rp2p-6cmp-jxj9