CVE-2026-50525: .NET Denial of Service Vulnerability
Analyzed
AliasesUBUNTU-CVE-2026-50525CGA-24vj-69gq-6v75CGA-26j2-grrj-gfgcCGA-2f29-h8mp-28w9CGA-2rq9-ggxw-2c3xCGA-3927-h5cg-fh92CGA-4cf5-ch9m-h4r3CGA-4j4h-4qrx-j695CGA-4jqx-fvgg-85gmCGA-4vvf-h3vr-vg7xCGA-4whh-c96j-637cCGA-562w-3jv3-c829CGA-575f-g7v3-cjw2CGA-57fv-3p8p-8hpjCGA-5frm-5q59-cvqrCGA-5h65-298g-8973CGA-68f6-vmq3-6w5jCGA-6rcf-9fjc-c62mCGA-6rrg-vm3w-5p6mCGA-6w3g-mw5v-r96pCGA-74h9-r895-mhjhCGA-75m2-hr7v-h47hCGA-7gj2-j2mh-4vvfCGA-7hp9-5c8f-65h6CGA-84mc-2ghm-99m7CGA-8f8r-q73m-rh3wCGA-8mx4-8mc5-7qf7CGA-958p-h3wm-2fvvCGA-9gw7-grxg-q97wCGA-9jvv-fcj6-2mr7CGA-9v4p-pmqx-9p45CGA-c2v7-p6cj-72xfCGA-ch96-3jcw-hxx6CGA-cmm4-mgwf-xp47CGA-cxhr-989f-jc82CGA-f2w2-jqh5-vjx3CGA-f499-8gvw-m675CGA-fch3-wmg8-ch85CGA-fj8g-72mv-2xqvCGA-fv3m-8hmw-x3gpCGA-g62p-26mf-hjv5CGA-g6r7-hj5c-c7m4CGA-gg96-ff63-63jcCGA-gmp5-jg28-w5pwCGA-h758-75w8-5ch4CGA-h7m5-v8c3-m2qjCGA-j7gg-c53f-pv93CGA-jg3v-pr54-whp7CGA-jrjx-cj99-fprrCGA-jv33-rqcc-c6h5CGA-jvxj-xj4j-69w6CGA-m2g7-52mp-2wc4CGA-mvfp-jv7r-p6h7CGA-p9fj-84f7-fhj5CGA-q698-5848-5xg6CGA-q8xw-rfh5-v88vCGA-q9cq-g6xm-h4w3CGA-qqmj-9426-38r9CGA-qrm3-82q2-pw8mCGA-qv3r-mqcr-ch7wCGA-r2mf-778w-cr2pCGA-rcmx-f9v7-5p2mCGA-rfqj-92wg-mw9mCGA-rj67-ghvv-rjp7CGA-rr7c-ffvf-7947CGA-rv5x-gh9h-f38vCGA-v2xj-5vm7-2wfqCGA-v33x-6fgc-ghf7CGA-v4fc-f3vg-hvqfCGA-vj55-h2fx-wrwpCGA-vrqv-8gfp-crqmCGA-vxg4-67vc-whq5CGA-w9f5-vr7w-2m78CGA-wrhv-wrx3-524xCGA-x4cj-88x5-rff2CGA-xm2v-r22r-vgx7GHSA-8q5v-6pqq-x66hBIT-dotnet-2026-50525BIT-dotnet-sdk-2026-50525ALPINE-CVE-2026-50525
Published 14-07-2026Last modified 01-11-2026
Vulnerability summary
CVE-2026-50525 is a high (CVSS 7.5) vulnerability in microsoft microsoft .net framework 3.5. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67.5% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.17%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 2Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 01-11-2026Last modifiedVulnerability information updated.
Description
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:CSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.17%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.17% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Microsoft17 products
- microsoft .net framework 3.5≥ 3.5.0, < 2.0.50727.9182 & 3.0.30729.9168
- microsoft .net framework 3.5 and 4.7.2≥ 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
- microsoft .net framework 3.5 and 4.8≥ 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
- microsoft .net framework 3.5 and 4.8.1≥ 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2≥ 4.7.0, < 4.7.4143.0
Chainguard8 products
- aspnet-8-targeting-pack< 8.0.131-r0
- dotnet-8-sdk< 8.0.129-r1
- dotnet-bootstrap-8< 8.0.129-r0 | < 8.0.130-r0
- dotnet-bootstrap-9< 9.0.120-r0
- dotnet-sdk-10.0.2< 10.0.204-r4
Wolfi8 products
- aspnet-8-targeting-pack< 8.0.131-r0
- dotnet-8-sdk< 8.0.129-r1
- dotnet-bootstrap-8< 8.0.129-r0 | < 8.0.130-r0
- dotnet-bootstrap-9< 9.0.120-r0
- dotnet-sdk-10.0.2< 10.0.204-r4
Ubuntu4 products
- dotnet10< 10.0.110-10.0.10-0ubuntu1~24.04.1 | < 10.0.110-10.0.10-0ubuntu1~26.04.1
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.129-8.0.29-0ubuntu1~22.04.1 | < 8.0.129-8.0.29-0ubuntu1~24.04.1
Alpine3 products
- dotnet10-runtime< 10.0.10-r0
- dotnet8-runtime< 8.0.29-r0
- dotnet9-runtime< 9.0.18-r0
NuGet1 product
- System.Security.Cryptography.Xml≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.4
6 vendors · 41 products
References
11 links
- github.com/dotnet/runtimePACKAGE