CVE-2026-47302

Aliases:GHSA-cvvh-rhrc-wg4qBIT-dotnet-2026-47302BIT-dotnet-sdk-2026-47302CGA-2924-79mc-pj7xCGA-3582-r762-xfhxCGA-54j2-34vg-434hCGA-5534-wj2c-fh83CGA-59rm-4xc7-6g59CGA-62wf-49jj-m55fCGA-64hh-pqxv-r4x6CGA-6fvj-mp3g-g83fCGA-6qmj-qh43-83jmCGA-6v2h-3q93-3fjpCGA-6wvc-3867-8wvpCGA-77xp-fcgw-399cCGA-7c2x-8fhf-q2v5CGA-7gvc-j28h-qp2rCGA-89vh-fqf9-wgr4CGA-8hp4-c627-v6vqCGA-8pfx-8m39-hwfrCGA-93fh-rwr7-rcpjCGA-9875-62xp-g54xCGA-cj6v-cw87-84j5CGA-cv92-j6qr-3qr3CGA-f3cj-8p2x-gm9jCGA-fchg-c3jj-mrggCGA-fqhg-476w-fxv5CGA-fr4j-q9wp-rqmwCGA-g679-p8gp-wr4wCGA-g84f-9x2p-m774CGA-g9p7-h6mw-3fmmCGA-ghph-c5rc-6mq5CGA-gj7q-r885-m9q2CGA-gq59-vxwp-64rcCGA-j2gx-jmx3-cmgmCGA-j2pf-cqwh-g2pwCGA-j764-2mc8-3xp3CGA-jf34-66r9-qx66CGA-jj9w-p9mg-vhqrCGA-jq3c-jcgv-c4x4CGA-jr5h-8gqp-c7hpCGA-m2x7-62h7-p3qgCGA-m43c-47xc-mhpxCGA-m4rq-qcjq-crcjCGA-m95r-mjc7-cq75CGA-m994-fq97-mrhpCGA-mjcc-whhg-gxm7CGA-mmf2-576w-chccCGA-mmwg-m756-988vCGA-p2qr-4cmf-3xmvCGA-p389-rjcx-8jjvCGA-pc55-m58w-c4hcCGA-phj3-69vf-xwfjCGA-pjfp-j9gr-x653CGA-pqhh-xh3c-fr7vCGA-q6wv-7w4v-2q76CGA-qjv3-hxpp-2xqcCGA-qv3r-w89w-4v99CGA-r4xh-qqjf-87cwCGA-r5w7-qpx4-3rwcCGA-r79h-pw4c-5v7xCGA-rhg6-mvw3-7w4rCGA-rwf8-pvr5-vgrcCGA-v597-p85w-ppxpCGA-v5mf-55pv-v53jCGA-vf69-rwfg-gw96CGA-vgvq-gqrg-pg92CGA-vr3m-hwm8-9845CGA-vxgh-f27j-p4wfCGA-vxr9-g2xr-j6vcCGA-w4q6-589x-62cqCGA-w4x8-qj2m-gp2fCGA-w5qg-qjrw-m8wxCGA-x496-m924-9xx4CGA-x6h3-72ph-8pr6CGA-x6rm-qx94-23mmCGA-x7pq-px3r-v96fCGA-x822-c7x5-272jCGA-xcgf-p7rr-cw28CGA-xgxp-rr67-j9w4CGA-xjr6-3jq4-x82jCGA-r2wp-rcrw-fxrh
Advisory lineage Upstream: 0 Downstream: 18
Analyzed
Published: 14 Jul 2026, 18:45
Last modified:17 Sept 2026, 22:28

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.03% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Jul 2026, 18:45
Published
Vulnerability first disclosed
17 Sept 2026, 22:28
Last Modified
Vulnerability information updated

Description

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.03%• Percentile: 62%

Techniques & Countermeasures

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • chainguard•aspnet-8-targeting-pack

    < 8.0.131-r0

  • chainguard•dotnet-8-sdk

    < 8.0.129-r1

  • chainguard•dotnet-bootstrap-8

    < 8.0.129-r0 | < 8.0.130-r0

  • chainguard•dotnet-bootstrap-9

    < 9.0.120-r0

  • chainguard•dotnet-sdk-10.0.2

    < 10.0.204-r4

  • chainguard•dotnet-sdk-10.0.3

    < 10.0.301-r5

  • chainguard•powershell

    < 7.6.4-r1

  • chainguard•promitor

    < 2.16.0-r3

  • wolfi•aspnet-8-targeting-pack

    < 8.0.131-r0

  • wolfi•dotnet-8-sdk

    < 8.0.129-r1

  • wolfi•dotnet-bootstrap-8

    < 8.0.129-r0 | < 8.0.130-r0

  • wolfi•dotnet-bootstrap-9

    < 9.0.120-r0

  • wolfi•dotnet-sdk-10.0.2

    < 10.0.204-r4

  • wolfi•dotnet-sdk-10.0.3

    < 10.0.301-r5

  • wolfi•powershell

    < 7.6.4-r1

  • wolfi•promitor

    < 2.16.0-r3

  • microsoft•microsoft .net framework 3.5

    ≥ 3.5.0, < 2.0.50727.8983 & 3.0.30729.8978

  • microsoft•microsoft .net framework 3.5 and 4.7.2

    ≥ 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

  • microsoft•microsoft .net framework 3.5 and 4.8

    ≥ 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

  • microsoft•microsoft .net framework 3.5 and 4.8.1

    ≥ 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

  • microsoft•microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2

    ≥ 4.7.0, < 4.7.4143.0

  • microsoft•microsoft .net framework 4.8

    ≥ 4.8.0, < 4.8.4803.0

  • microsoft•microsoft visual studio 2022 version 17.12

    ≥ 17.12.0, < 17.12.22

  • microsoft•microsoft visual studio 2022 version 17.14

    ≥ 17.14.0, < 17.14.36

  • microsoft•microsoft visual studio 2026 version 18.7

    ≥ 18.0, < 18.7.4

  • microsoft•.net

    ≥ 8.0.0, < 8.0.29 | ≥ 9.0.0, < 9.0.18 | ≥ 10.0.0, < 10.0.6

  • microsoft•.net 10.0

    ≥ 10.0.0, < 10.0.6 | ≥ 10.0.0, < 10.0.10

  • microsoft•.net 8.0

    ≥ 8.0.0, < 8.0.29

  • microsoft•.net 9.0

    ≥ 9.0.0, < 9.0.18

  • microsoft•.net_framework

    4.8 | 4.6.2 | 4.7 | 4.7.1 | 4.7.2 | 3.5 | 4.8.1

  • microsoft•visual_studio_2022

    ≥ 17.12.0, < 17.12.22 | ≥ 17.14.0, < 17.14.36

  • microsoft•visual_studio_2026

    ≥ 18.7.0, < 18.7.4

  • NuGet•Microsoft.NETCore.App.Runtime.linux-arm

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.linux-arm64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.linux-musl-arm

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.linux-musl-arm64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.linux-musl-x64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.linux-x64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.osx-arm64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.osx-x64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.win-arm

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.win-arm64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.win-x64

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•Microsoft.NETCore.App.Runtime.win-x86

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

  • NuGet•System.Security.Cryptography.Xml

    ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.4

References (6)