CVE-2026-26171: microsoft .net Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2026-26171CGA-237j-4459-62h4CGA-24r3-jwhv-w68mCGA-29vw-g4xh-pgwmCGA-2c3j-9r33-7j4jCGA-2crc-fjpv-w549CGA-2hqf-jq3r-xg36CGA-2mpw-8wpv-9c4qCGA-2rq7-6v3g-2c7rCGA-2w57-h5pg-hx8vCGA-2x7f-9v26-q873CGA-2xxw-5wp8-8v6gCGA-3697-gcxq-446hCGA-3h7f-3m6m-frxfCGA-426j-4fcm-663wCGA-46hh-239r-hvmmCGA-4822-v448-ph6pCGA-4fw2-ffjq-4m72CGA-4vwc-mp7m-5hqgCGA-4xq7-35q5-qv8hCGA-57rw-rxgf-2cmxCGA-5ghj-56g7-5x5fCGA-5vmc-qg67-c7qmCGA-6367-fr8m-wjp9CGA-6546-xprq-46p9CGA-67jv-4669-vmwmCGA-6xwm-j4h9-w965CGA-73ww-7pr9-h66mCGA-78jj-5542-phmmCGA-7f5j-q32p-7pr9CGA-823v-5442-4g34CGA-83wr-5g85-w9pcCGA-84g8-hq28-5668CGA-866p-w989-hgqcCGA-87gh-q7wq-q9j9CGA-892m-gf5g-7fm9CGA-8fc2-4f9r-5gqmCGA-8g77-7358-p9wmCGA-8jc2-xh7h-xr59CGA-8p5x-4mjv-qq7hCGA-8rv4-2jjq-cxcpCGA-8v49-g5xc-8v7rCGA-8vxf-gj7f-44p9CGA-8w52-hx87-78xhCGA-8xc6-frg3-q74gCGA-9587-45vr-4vfrCGA-95qc-772r-8hwfCGA-96vc-54fp-4g3hCGA-97g4-9524-4rxcCGA-9g44-4953-h5rwCGA-9h5r-hghx-c9q6CGA-9vj7-4mmm-46mhCGA-c24h-45pm-gj3fCGA-c3g9-jh82-769qCGA-c67m-4h4h-6qxfCGA-c6mg-7pq2-q2wrCGA-c9qx-6xxr-jh9vCGA-cg9p-j6x9-r776CGA-chh3-h679-wrvjCGA-chmw-xqph-qp8mCGA-cjfv-gjch-439hCGA-cjg5-44h8-wqvmCGA-cjjj-h3qv-9mqpCGA-cmfw-552r-phrfCGA-cwxm-h77c-6w6qCGA-f2rc-h58g-ph38CGA-f7cp-c9rp-rg9pCGA-f8wp-cxq5-gm7rCGA-fv28-p969-fch5CGA-fxf2-qvwh-m3hpCGA-g7wm-8hxj-c8mqCGA-g8mq-v633-c5f9CGA-g94r-fv86-phpjCGA-g9gv-gmvh-64g7CGA-gc9w-3p5m-7j7cCGA-gq63-jp9v-j6xrCGA-gqjc-xhrf-8vqmCGA-gqqq-v7jj-7wfpCGA-gvjx-g52p-5qrpCGA-hggm-cv33-f9pgCGA-hm5h-xw88-fc7xCGA-hq2q-63fx-pcc6CGA-hr9w-r742-h2vxCGA-hrh7-5v38-67j8CGA-jppx-g565-pxp3CGA-jv8r-c3mr-9wxwCGA-jxq2-868v-53wpCGA-m696-5mfh-765hCGA-m78j-56f3-g723CGA-mpcp-m863-2jgqCGA-mpcx-95mq-r877CGA-mpmx-mw76-5476CGA-mq5v-rrfc-qvhjCGA-mvcw-84fc-34qjCGA-p63p-7vfh-q9mhCGA-p7w9-2qvp-fjfqCGA-pfc3-27jw-v6qpCGA-pqvr-jjxw-7rfqCGA-prmc-r2fj-cv64CGA-qcjm-c428-9f7mCGA-qhfg-h2wm-mxh9CGA-qjwq-6wp9-9ggcCGA-r6gp-mh98-j7gwCGA-r8c8-grh9-8q2cCGA-r9rq-cwph-4qgwCGA-rpg3-872m-rx9mCGA-rrqp-h5p8-xh2gCGA-rxcc-pqgm-83q6CGA-rxcj-xvr3-m249CGA-v34q-7w7r-3g5pCGA-v5xh-953m-m36rCGA-v6rw-7pxm-f72pCGA-v77g-2xcj-v4vpCGA-vj8x-7m5j-3f3cCGA-vmjp-v3mg-vrpvCGA-vwpp-qwvv-p65mCGA-w34p-q8xq-cv5xCGA-w5v4-8hgf-86r4CGA-w6gx-8xwc-22c6CGA-w99f-4c8h-4g98CGA-wh56-ff48-rgcqCGA-wj5q-rrm8-g4v5CGA-wm2j-chw2-6g4hCGA-wpx6-f2x6-ff7xCGA-wqc6-v45f-23pgCGA-wqjf-6mg5-7g9rCGA-wrcx-687g-4gjrCGA-ww8x-32c8-4m5wCGA-xfq9-85xx-64cxCGA-xg42-c4m5-824vCGA-xvc5-mmq6-4r5mGHSA-w3x6-4m5h-cxqfBIT-dotnet-2026-26171BIT-dotnet-sdk-2026-26171BIT-powershell-2026-26171
Published 14-04-2026Last modified 15-10-2026
Vulnerability summary
CVE-2026-26171 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in microsoft .net. EPSS estimates a 2.26% chance of exploitation in the next 30 days, higher than 82.7% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
2.26%
0%100%
Low · +0.51 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 3Timeline
- 14-04-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:CSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.26%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
+0.51 pp
From 1.75% on 19-09-2026
19-09-202619-10-2026
EPSS score2.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
- CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Affected systems
Chainguard10 products
- dotnet-10-sdk< 10.0.106-r0
- dotnet-8-sdk< 8.0.126-r0
- dotnet-9-sdk< 9.0.116-r0
- dotnet-bootstrap-8< 8.0.127-r0
- dotnet-bootstrap-9< 9.0.116-r0 | < 9.0.117-r0
Wolfi10 products
- dotnet-10-sdk< 10.0.106-r0
- dotnet-8-sdk< 8.0.126-r0
- dotnet-9-sdk< 9.0.116-r0
- dotnet-bootstrap-8< 8.0.127-r0
- dotnet-bootstrap-9< 9.0.116-r0 | < 9.0.117-r0
Microsoft7 products
- .net≥ 10.0.0, < 10.0.6 | ≥ 8.0.0, < 8.0.26 | ≥ 9.0.0, < 9.0.15
- .net 10.0≥ 10.0.0, < 10.0.6
- .net 8.0≥ 8.0.0, < 8.0.26
- .net 9.0≥ 9.0.0, < 9.0.15
- powershell≥ 7.5, < 7.5.6 | ≥ 7.6, < 7.6.1
Ubuntu5 products
- dotnet10< 10.0.106-10.0.6-0ubuntu1~24.04.1 | < 10.0.106-10.0.6-0ubuntu1~25.10.1 | < 10.0.107-10.0.7-0ubuntu1~26.04.1
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.126-8.0.26-0ubuntu1~22.04.1 | < 8.0.126-8.0.26-0ubuntu1~24.04.1 | < 8.0.126-8.0.26-0ubuntu1~25.10.1
- dotnet9< 9.0.116-9.0.15-0ubuntu1~25.10.1
NuGet1 product
- System.Security.Cryptography.Xml≥ 10.0.0, < 10.0.6 | ≥ 9.0.0, < 9.0.15 | ≥ 8.0.0, < 8.0.3
5 vendors · 33 products
References
30 linksShow all 30 references
- github.com/dotnet/runtimePACKAGE