Executive brief
A vulnerability exists in the .NET component responsible for handling WebSockets, a technology used for real-time communication in web applications. An attacker can exploit this flaw to crash or freeze an application remotely, leading to a denial of service. This could disrupt business operations and impact the availability of services for customers. Organizations using .NET 8, 9, or 10 should update to the latest patched versions immediately.
Technical details
A denial of service vulnerability exists in .NET within the System.Net.WebSockets namespace due to an unchecked input for a loop condition (CWE-606). The flaw allows a remote, unauthenticated attacker to send specially crafted network traffic that triggers an infinite or resource-exhaustive loop. This results in the exhaustion of CPU or memory resources, effectively denying service to legitimate users. The vulnerability affects .NET 8, 9, and 10 across Windows, Linux, and macOS platforms. Microsoft has released patches in versions 8.0.30, 9.0.19, and 10.0.11 to address this issue.
Affected products
- Microsoft .NET Core App Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10
Timeline
- 2026-08-11: disclosed
- 2026-08-11: advisory
- 2026-08-11: patched