CVE-2026-42899

high

Published 2026-05-27 · Modified 2026-05-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.5

Description

Important: .NET 9.0 security update

Predictions

Exploit likelihood

83%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description dotnet: .NET: infinite loop allows an attacker to cause a denial of service Red Hat statement As this flaw allows an unauthenticated remote attacker to cause a denial of service, it has been rated with an important severity. CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Errata / fixed releases ProductPackageAdvisoryReleased Red Hat Enterprise Linux…

Description

dotnet: .NET: infinite loop allows an attacker to cause a denial of service

Red Hat statement

As this flaw allows an unauthenticated remote attacker to cause a denial of service, it has been rated with an important severity.

CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Errata / fixed releases

Product	Package	Advisory	Released
Red Hat Enterprise Linux 10	`dotnet8.0-0:8.0.127-1.el10_2`	RHSA-2026:21286	2026-05-27T00:00:00Z
Red Hat Enterprise Linux 10	`dotnet9.0-0:9.0.117-1.el10_2`	RHSA-2026:21754	2026-05-28T00:00:00Z
Red Hat Enterprise Linux 8	`dotnet8.0-0:8.0.127-1.el8_10`	RHSA-2026:21291	2026-05-27T00:00:00Z
Red Hat Enterprise Linux 8	`dotnet9.0-0:9.0.117-1.el8_10`	RHSA-2026:21294	2026-05-27T00:00:00Z
Red Hat Enterprise Linux 8	`dotnet10.0-0:10.0.108-1.el8_10`	RHSA-2026:21295	2026-05-27T00:00:00Z
Red Hat Enterprise Linux 9	`dotnet8.0-0:8.0.127-1.el9_8`	RHSA-2026:21293	2026-05-27T00:00:00Z
Red Hat Enterprise Linux 9	`dotnet9.0-0:9.0.117-1.el9_8`	RHSA-2026:21296	2026-05-27T00:00:00Z
Red Hat Enterprise Linux 9	`dotnet10.0-0:10.0.108-1.el9_8`	RHSA-2026:21297	2026-05-27T00:00:00Z
Red Hat Hardened Images	`dotnet10-0-main-10.0.108-1.hum1`	RHSA-2026:17464	2026-05-14T00:00:00Z
Red Hat Hardened Images	`dotnet9-0-main-9.0.117-1.hum1`	RHSA-2026:17527	2026-05-14T00:00:00Z
Red Hat Hardened Images	`dotnet8-0-main-8.0.127-1.hum1`	RHSA-2026:17682	2026-05-14T00:00:00Z

Package state

Product	Package	State
Red Hat Enterprise Linux 10	`dotnet10.0`	Affected

Apply commands

bash fix

Apply RHSA-2026:21286 for Red Hat Enterprise Linux 10

yum update -y dotnet8
# or:
dnf upgrade -y dotnet8

Affected

Vendor	Product	Version
redhat	Red Hat Enterprise Linux 10	`Affected`

OS impact

Windows Affected 1 release

Version	Status	Fixed in
—	Affected	—

AlmaLinux Fixed 2 releases

Version	Status	Fixed in
9	Fixed	`aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_8.aarch64.rpm`
8	Fixed	`dotnet-sdk-8.0-source-built-artifacts-8.0.127-1.el8_10.x86_64.rpm`

Linux kernel Fixed 1 release

Version	Status	Fixed in
-	Not affected	—

macOS Fixed 1 release

Version	Status	Fixed in
-	Not affected	—

Red Hat Fixed 2 releases

Version	Status	Fixed in
9	Fixed	—
8	Fixed	—

Package impact

Ecosystem	Package	Vulnerable	Fixed
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	`>=8.0.0,<8.0.27`	`8.0.27`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	`>=10.0.0,<10.0.8`	`10.0.8`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	`>=9.0.0,<9.0.16`	`9.0.16`
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	`>=10.0.0,<10.0.8`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.osx-x64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.osx-x64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.osx-arm64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.osx-arm64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-x64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-x64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-arm	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-arm	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.win-x86	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.win-x86	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.win-x64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.win-x64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.win-arm64	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.win-arm64	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.win-arm	`>= 10.0.0, <= 10.0.7`	`10.0.8`
NUGET	Microsoft.AspNetCore.App.Runtime.win-arm	`>= 9.0.0, <= 9.0.15`	`9.0.16`
NUGET	Microsoft.AspNetCore.App.Runtime.osx-x64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.osx-arm64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-x64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-arm64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.linux-arm	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.win-x86	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.win-x64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.win-arm64	`>= 8.0.0, <= 8.0.26`	`8.0.27`
NUGET	Microsoft.AspNetCore.App.Runtime.win-arm	`>= 8.0.0, <= 8.0.26`	`8.0.27`

Application impact

Vendor	Product	Versions	Fixed
microsoft	.net	`{"startIncluding":"8.0.0","endExcluding":"8.0.27"}`	`8.0.27`

References

CWEs

CWE-835

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.