# CVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

Source: https://junglewise.ai/threats/cve-2026-62901-microsoft-net-denial-of-service-in-system-net-websockets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-08-11  
License: CC BY 4.0 with a link back

CVE-2026-62901 · Severity: high · CVSS 7.5 · Published 2026-08-11

A vulnerability exists in the .NET component responsible for handling WebSockets, a technology used for real-time communication in web applications. An attacker can exploit this flaw to crash or freeze an application remotely, leading to a denial of service. This could disrupt business operations and impact the availability of services for customers. Organizations using .NET 8, 9, or 10 should update to the latest patched versions immediately.

Technologies: [Apple macOS](https://junglewise.ai/threats/technologies/macos), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Microsoft .Net](https://junglewise.ai/threats/technologies/microsoft-net), [Microsoft Visual Studio 2022](https://junglewise.ai/threats/technologies/visual-studio-2022), [Microsoft Visual Studio 2026](https://junglewise.ai/threats/technologies/visual-studio), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows), [Microsoft.NetCore.App.Runtime.linux-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm), [Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm), [Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-x64), [Microsoft.NetCore.App.Runtime.linux-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-x64), [Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-arm64), [Microsoft.NetCore.App.Runtime.osx-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-x64), [Microsoft.NetCore.App.Runtime.win-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-win-arm64), [Microsoft.NetCore.App.Runtime.win-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-win-x64), [Microsoft.NetCore.App.Runtime.win-x86 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-win-x86). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Linux](https://junglewise.ai/threats/vendors/linux), [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-62901 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62901 being exploited in the wild.

**How severe is CVE-2026-62901?** High severity, with a CVSS score of 7.5, published 11 August 2026.

**Which products and versions are affected?** Microsoft .NET Core App Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; and 8 more.

**Is there a fix for CVE-2026-62901?** Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62901 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62901?** Check whether you run Apple macOS, Linux Kernel, Microsoft .Net or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.win-arm64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.win-x64 --version 10.0.11
  ```

- Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.win-x86 --version 10.0.11
  ```


## Technical details

A denial of service vulnerability exists in .NET within the System.Net.WebSockets namespace due to an unchecked input for a loop condition (CWE-606). The flaw allows a remote, unauthenticated attacker to send specially crafted network traffic that triggers an infinite or resource-exhaustive loop. This results in the exhaustion of CPU or memory resources, effectively denying service to legitimate users. The vulnerability affects .NET 8, 9, and 10 across Windows, Linux, and macOS platforms. Microsoft has released patches in versions 8.0.30, 9.0.19, and 10.0.11 to address this issue.

## Affected products

- Microsoft .NET Core App Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10

## Identifiers

- CVE-2026-62901
- GHSA-m93f-wj8c-rp8p

## Timeline

- 2026-08-11: disclosed
- 2026-08-11: advisory
- 2026-08-11: patched

## References

- [https://github.com/dotnet/runtime/security/advisories/GHSA-m93f-wj8c-rp8p](https://github.com/dotnet/runtime/security/advisories/GHSA-m93f-wj8c-rp8p)
- [https://github.com/dotnet/announcements/issues/428](https://github.com/dotnet/announcements/issues/428)
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62901](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62901)
- [https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-m93f-wj8c-rp8p](https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-m93f-wj8c-rp8p)

## Related threats

- [Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-224be73b)
- [Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-6a4b9d28)
- [Microsoft Visual Studio deserialization remote code execution](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-1eb2f932)
- [Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-ba83a5c9)
- [Microsoft Visual Studio stack-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-d956164d)