CVE-2026-57108: Microsoft .NET Core type confusion denial of service

CVE-2026-57108 · Severity: high · CVSS 7.5 · Published 2026-07-14

A security vulnerability has been identified in the Microsoft .NET runtime, which is used to build and run various software applications on Linux and macOS. An attacker could exploit this flaw by providing a specially crafted digital certificate, causing the application to crash or become unresponsive. This results in a denial of service, potentially disrupting business operations and service availability.

Technologies: Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet), Microsoft.NetCore.App.Runtime.linux-x64 (NuGet), Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet), Microsoft.NetCore.App.Runtime.osx-x64 (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-57108 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57108 being exploited in the wild.
How severe is CVE-2026-57108?
High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?
Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; and 4 more.
Is there a fix for CVE-2026-57108?
Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57108 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57108?
Check whether you run Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 10.0.10

Technical details

A type confusion vulnerability (CWE-843) exists in the .NET runtime cryptography layer, specifically within the CryptoNative_GetX509NameInfo function. The issue affects .NET 8, 9, and 10 running on Linux and macOS across all architectures. An unauthenticated remote attacker can exploit this by submitting a specially crafted X.509 certificate for parsing, leading to a denial of service (DoS) condition. The vulnerability is resolved in .NET versions 8.0.29, 9.0.18, and 10.0.10. Developers must update their runtimes and redeploy any self-contained applications.

Affected products

  • Microsoft .NET 10.0 >= 10.0.0, <= 10.0.9
  • Microsoft .NET 9.0 >= 9.0.0, <= 9.0.17
  • Microsoft .NET 8.0 >= 8.0.0, <= 8.0.28

Identifiers

  • CVE-2026-57108
  • GHSA-rp2p-6cmp-jxj9

Timeline

  • 2026-07-14: advisory: Initial advisory publication
  • 2026-07-20: other: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.