Is CVE-2026-62901 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62901 being exploited in the wild.

How severe is CVE-2026-62901?

High severity, with a CVSS score of 7.5, published 11 August 2026.

Is there a fix for CVE-2026-62901?

Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62901 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62901?

Check whether you run Apple macOS, Linux Kernel, Microsoft .Net or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-62901 · Severity: high · CVSS 7.5 · Published 2026-08-11

A vulnerability exists in the .NET component responsible for handling WebSockets, a technology used for real-time communication in web applications. An attacker can exploit this flaw to crash or freeze an application remotely, leading to a denial of service. This could disrupt business operations and impact the availability of services for customers. Organizations using .NET 8, 9, or 10 should update to the latest patched versions immediately.

Quick answers

Is CVE-2026-62901 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62901 being exploited in the wild.
How severe is CVE-2026-62901?: High severity, with a CVSS score of 7.5, published 11 August 2026.
Which products and versions are affected?: Microsoft .NET Core App Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; and 8 more.
Is there a fix for CVE-2026-62901?: Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62901 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62901?: Check whether you run Apple macOS, Linux Kernel, Microsoft .Net or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 10.0.11

Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 10.0.11

Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 10.0.11

Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.win-arm64 --version 10.0.11

Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.win-x64 --version 10.0.11

Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.win-x86 --version 10.0.11

Technical details

A denial of service vulnerability exists in .NET within the System.Net.WebSockets namespace due to an unchecked input for a loop condition (CWE-606). The flaw allows a remote, unauthenticated attacker to send specially crafted network traffic that triggers an infinite or resource-exhaustive loop. This results in the exhaustion of CPU or memory resources, effectively denying service to legitimate users. The vulnerability affects .NET 8, 9, and 10 across Windows, Linux, and macOS platforms. Microsoft has released patches in versions 8.0.30, 9.0.19, and 10.0.11 to address this issue.

Affected products

Microsoft .NET Core App Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10

Identifiers

CVE-2026-62901
GHSA-m93f-wj8c-rp8p

Timeline

2026-08-11: disclosed
2026-08-11: advisory
2026-08-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.