# CVE-2026-57108: Microsoft .NET Core type confusion denial of service

Source: https://junglewise.ai/threats/cve-2026-57108-microsoft-net-core-type-confusion-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-57108 · Severity: high · CVSS 7.5 · Published 2026-07-14

A security vulnerability has been identified in the Microsoft .NET runtime, which is used to build and run various software applications on Linux and macOS. An attacker could exploit this flaw by providing a specially crafted digital certificate, causing the application to crash or become unresponsive. This results in a denial of service, potentially disrupting business operations and service availability.

Technologies: [Microsoft.NetCore.App.Runtime.linux-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm), [Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm), [Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-x64), [Microsoft.NetCore.App.Runtime.linux-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-x64), [Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-arm64), [Microsoft.NetCore.App.Runtime.osx-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-x64). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-57108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57108 being exploited in the wild.

**How severe is CVE-2026-57108?** High severity, with a CVSS score of 7.5, published 14 July 2026.

**Which products and versions are affected?** Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; and 4 more.

**Is there a fix for CVE-2026-57108?** Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57108 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57108?** Check whether you run Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 10.0.10
  ```

- Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 10.0.10
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 10.0.10
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 10.0.10
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 10.0.10
  ```

- Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 10.0.10
  ```

- Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 10.0.10
  ```

- Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.10 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 10.0.10
  ```


## Technical details

A type confusion vulnerability (CWE-843) exists in the .NET runtime cryptography layer, specifically within the CryptoNative_GetX509NameInfo function. The issue affects .NET 8, 9, and 10 running on Linux and macOS across all architectures. An unauthenticated remote attacker can exploit this by submitting a specially crafted X.509 certificate for parsing, leading to a denial of service (DoS) condition. The vulnerability is resolved in .NET versions 8.0.29, 9.0.18, and 10.0.10. Developers must update their runtimes and redeploy any self-contained applications.

## Affected products

- Microsoft .NET 10.0 >= 10.0.0, <= 10.0.9
- Microsoft .NET 9.0 >= 9.0.0, <= 9.0.17
- Microsoft .NET 8.0 >= 8.0.0, <= 8.0.28

## Identifiers

- CVE-2026-57108
- GHSA-rp2p-6cmp-jxj9

## Timeline

- 2026-07-14: advisory: Initial advisory publication
- 2026-07-20: other: Advisory updated

## References

- [https://github.com/dotnet/runtime/security/advisories/GHSA-rp2p-6cmp-jxj9](https://github.com/dotnet/runtime/security/advisories/GHSA-rp2p-6cmp-jxj9)
- [https://github.com/dotnet/announcements/issues/408](https://github.com/dotnet/announcements/issues/408)
- [https://github.com/dotnet/runtime/issues/130707](https://github.com/dotnet/runtime/issues/130707)
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108)
- [https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-rp2p-6cmp-jxj9](https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-rp2p-6cmp-jxj9)

## Related threats

- [Microsoft .NET algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-120796-inefficient-algorithmic-complexity-in-net-allows-an-unauthorized)
- [.NET framework insecure failure mode security bypass](https://junglewise.ai/threats/cve-2026-118746-not-failing-securely-failing-open-in-net-allows-an-unauthorized)
- [.NET stack-based buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-109475-stack-based-buffer-overflow-in-net-allows-an-unauthorized)
- [Microsoft .NET Brotli decoder out-of-bounds write](https://junglewise.ai/threats/microsoft-security-advisory-net-brotli-decoder-out-of-bounds-write-b42e3b43)
- [Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96233-microsoft-security-advisory-net-and-visual-studio-denial-of)