CVE-2026-84008: microsoft microsoft .net framework 3.5 Inefficient Algorithmic Complexity
CVSS: 7.5v3.1HighAwaiting analysis
AliasesGHSA-846f-f764-76mxCGA-252q-g9hx-4382CGA-2crr-6mmh-fw78CGA-2cvg-777v-w728CGA-2g7f-93qf-g697CGA-2qhp-59rf-rf3vCGA-2v76-63g7-jqmwCGA-3c62-gmcc-c6hfCGA-3mjp-92fp-9xpvCGA-43w3-p6pm-jx5rCGA-45pw-cwfr-mghfCGA-4987-h66p-m39cCGA-4c72-cvvq-fj4mCGA-4c85-3vgr-m728CGA-4hj8-65cf-jrfvCGA-4wwg-qh54-h4cpCGA-4x77-j4pm-7xcrCGA-53wc-7wx2-4f2rCGA-54xq-68c9-8xcjCGA-56fg-322f-2frcCGA-5jr5-cjvr-542jCGA-5mh3-89x9-p2ccCGA-6c2x-563g-3r87CGA-6gp9-mmhw-27f4CGA-6p44-79fr-882wCGA-6q6c-w74c-qf84CGA-74j5-hcpp-2362CGA-75vv-766x-96rcCGA-766w-jj8p-5jgcCGA-77j9-mxcw-m2pjCGA-7c4h-765j-664rCGA-7q34-g5cp-6h8xCGA-7wmg-9pfp-62cjCGA-7x7q-rr4f-ph4rCGA-7x7w-vmgg-gw2gCGA-828r-p36f-w7q6CGA-83jq-wwrx-8hwrCGA-8ch5-57w9-9r2pCGA-8fjj-fxp5-r8wwCGA-8q63-9454-39c5CGA-8q9j-rc48-x52wCGA-963h-6f8v-rgmcCGA-96qm-vcgg-wq53CGA-973m-jjq3-cxc7CGA-97fg-mr33-3qpqCGA-997f-h3hq-7wv5CGA-9p89-qxm7-92v2CGA-9ppg-h54h-p68hCGA-c5wp-3rr7-5ch2CGA-cf76-v3c2-rj8fCGA-cg54-3wmm-9vxjCGA-cggf-ghmp-h496CGA-cr5j-2xjf-92vcCGA-fgfg-wp5w-2phmCGA-fq26-r6vr-v37qCGA-fqmm-vrxv-9p98CGA-fvxw-6x89-55jqCGA-g42m-rqw6-cpjqCGA-gf8f-mj85-7g63CGA-gfmj-m5f4-qxcmCGA-gfq4-cf5x-5pq5CGA-ggrg-96pm-9cfxCGA-gm6x-mvp2-vcvfCGA-gpxp-m2g3-7m56CGA-gr25-m7rq-j788CGA-gv3h-rqqc-r584CGA-h65c-c3j3-v4qrCGA-h97p-vm4w-m67xCGA-hwqf-66mp-ghx9CGA-j238-9f6f-g2w3CGA-j378-cfqx-q2g9CGA-j6v8-53cg-wxp7CGA-j7g6-5m87-wgw9CGA-jcwp-gr78-4423CGA-jg2g-9j2h-cpgcCGA-jhhw-jpp4-jx57CGA-jj28-6mvq-xrh9CGA-jwf7-623f-vxrgCGA-jwvm-qrgq-cpgcCGA-m62c-7wp5-8mh5CGA-m8hh-x75j-7rcpCGA-mmf3-j3q5-p7v2CGA-mmfp-qmvx-7g72CGA-mqxj-jh39-h42mCGA-mrxf-5x6r-489pCGA-p3f2-rfph-hwxvCGA-p642-2gh9-mrqpCGA-p6xr-8grc-3rxjCGA-pc6j-p27c-4w7wCGA-pmf3-9j3w-4r6rCGA-pqjf-x2r3-f6ggCGA-pqmc-4wrm-jqxwCGA-q2xp-5g3m-g658CGA-q8cr-9w3w-rjmxCGA-qg4w-cpjf-79c2CGA-qgcp-w6xj-62hjCGA-qhf6-wh43-qjc9CGA-qqqh-5954-qf8pCGA-qvj5-6q6x-p4q9CGA-r7jm-vhph-r8cpCGA-r839-fr83-9wfwCGA-rcr7-xgq3-4r3vCGA-rpqg-9qhh-2243CGA-v57c-q5hh-pg6gCGA-v8g2-qjw7-93q2CGA-vcfp-hqq8-7mf2CGA-vfvc-j5w4-89xxCGA-vmgw-f799-82f8CGA-w4r2-5q4g-r9g7CGA-w9jm-74qg-jpv3CGA-wx87-fwvq-cxphCGA-x275-f6j5-q6r9CGA-xfj5-p2vv-6mwgCGA-xj4g-h98g-qvh7CGA-xjjj-wr2c-pm6fCGA-xrrx-x3r5-f5vgCGA-xxhp-6qm3-x2cqCGA-2w88-5jjj-pp58CGA-6w7p-r97w-6ch4CGA-7w57-hcqv-mwj2CGA-8p4w-8r2r-c66hCGA-9q53-5fmm-x5v4CGA-cjgw-hmxw-mp8fCGA-p8p2-mp83-653hCGA-q6g2-5cw4-77j4CGA-r5j6-7pgr-h3f3CGA-rqx2-995w-mrx8CGA-wjhq-r8jq-7xxpCGA-wvhf-23rg-m8w7CGA-xjvf-99c3-q4qvCGA-3rr5-2cqg-fj3hCGA-44wp-6rxj-592hCGA-6m5c-2953-rjxfCGA-77q6-x24m-25gxCGA-gcmf-qw43-9338CGA-j857-3h8q-q558CGA-mx3p-pgv9-c8h8CGA-pqq7-vgfm-4wr2CGA-qqrv-jp54-2q4rCGA-4975-9552-9p58CGA-68v3-767g-jgw2CGA-cq43-445m-fqx4CGA-gg6p-mx56-h6qwCGA-h65x-76ch-9pmjCGA-9c2m-gwjm-33q6CGA-gwgj-7fc8-2x79CGA-pm5f-6xjg-92xjCGA-22cx-c559-4xvfCGA-2987-8mw5-9fr4CGA-43wq-7cg7-j8whCGA-6ff5-q4pv-8hhpCGA-94p5-wf72-25v8CGA-fv3r-gcx6-657vCGA-hfgw-rgx9-jwxfCGA-3cwq-q526-5mh2CGA-h7rj-6cgx-2gq2UBUNTU-CVE-2026-84008
Published 13-10-2026Last modified 19-10-2026
Vulnerability summary
CVE-2026-84008 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in microsoft microsoft .net framework 3.5. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.7% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.77%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 13-10-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:CSourcesAll 5 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
14-10-202619-10-2026
EPSS score0.77%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard13 products
- actions-runnerAll versions (No fix recorded) | < 2.338.0-r2
- dotnet-10-sdkAll versions (No fix recorded) | < 10.0.113-r1
- dotnet-8-sdkAll versions (No fix recorded) | < 8.0.132-r0
- dotnet-9-sdkAll versions (No fix recorded) | < 9.0.122-r0
- dotnet-bootstrap-8All versions (No fix recorded)
Microsoft11 products
- microsoft .net framework 3.5≥ 3.5.0, < 2.0.50727.9188 AND 3.0.30729.9171
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2≥ 3.0.0.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
- microsoft .net framework 3.5 and 4.7.2≥ 4.7.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
- microsoft .net framework 3.5 and 4.8≥ 4.8.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
- microsoft .net framework 3.5 and 4.8.1≥ 4.8.1, < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Wolfi11 products
- dotnet-10-sdkAll versions (No fix recorded) | < 10.0.113-r1
- dotnet-8-sdkAll versions (No fix recorded) | < 8.0.132-r0
- dotnet-9-sdkAll versions (No fix recorded) | < 9.0.122-r0
- dotnet-bootstrap-8All versions (No fix recorded)
- dotnet-bootstrap-9All versions (No fix recorded)
Ubuntu5 products
- dotnet10All versions (No fix recorded)
- dotnet11All versions (No fix recorded)
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8All versions (No fix recorded)
NuGet1 product
- System.Security.Cryptography.Pkcs≥ 10.0.0, < 10.0.13 | ≥ 11.0.0-preview.1, < 11.0.0-rc.2 | ≥ 8.0.0, < 8.0.2 | ≥ 9.0.0, < 9.0.21
5 vendors · 41 products
References
9 links
- github.com/dotnet/runtimePACKAGE
