{"schemaVersion":3,"id":"CVE-2026-96958","aliases":["GHSA-r955-8q5j-3h83","CGA-2389-7c5h-v858","CGA-29v3-r89j-g8xx","CGA-2mm3-cc6r-8hjw","CGA-2rg2-2rfm-xmmr","CGA-328q-chx9-8vqp","CGA-39fx-qx37-hppx","CGA-3mg2-qrpg-x9vh","CGA-4f33-jr3m-7863","CGA-4g89-6f62-gpr7","CGA-4j63-cc58-69q7","CGA-4pxm-vx4v-6gw3","CGA-4vw4-rfc3-q3f3","CGA-56x6-qpj3-j267","CGA-572j-vpm7-q85g","CGA-5j28-338h-8x65","CGA-5j9c-83rj-7mqj","CGA-5qvf-76hj-4j43","CGA-5w24-2c6g-6vx8","CGA-6qvw-h4v7-f78q","CGA-74rj-8w28-pxrg","CGA-75j7-h3mp-fx42","CGA-765f-94qp-fr4m","CGA-7f87-rx2f-55w8","CGA-7h8w-xrpp-mff8","CGA-82gh-gcm8-5rxh","CGA-84f6-cpmh-64vp","CGA-86qr-37c7-fqm8","CGA-87g7-jfp2-2hr3","CGA-88qg-vvxm-phxj","CGA-92fq-2792-fh6j","CGA-93h3-v387-hccw","CGA-9c4w-rrcg-qxw8","CGA-9mwf-456p-qvpx","CGA-9qvq-7c8g-5pq4","CGA-c3f4-9gpw-248r","CGA-c499-hfw2-r36h","CGA-c8xw-w2fp-9pgg","CGA-cqf4-c54r-6xc4","CGA-cr33-p3r6-prv4","CGA-f473-4j2p-f7f7","CGA-fgrv-f4cx-c454","CGA-fgx4-4vf8-846q","CGA-fj24-mq2j-4f8w","CGA-fv79-694p-7q86","CGA-g553-gqq6-rp4q","CGA-gjgv-cx6f-3wwm","CGA-grx4-cpqq-v5wm","CGA-grxj-8fr8-2w5j","CGA-gx6g-6fcg-35q2","CGA-h26h-6x99-rjpf","CGA-h9rg-fm72-hj97","CGA-hjx6-gvhc-6c76","CGA-hq8r-2223-h2mf","CGA-j36x-r6f7-6j2v","CGA-j77x-4v48-h824","CGA-j7vh-xhw4-xwh9","CGA-j88q-jxpq-wfxq","CGA-j9pv-54xp-m59r","CGA-jhxg-h7rq-5rv5","CGA-jp5m-8pfx-m8m4","CGA-mgqf-r6mm-xfq3","CGA-mh89-m37m-r5w8","CGA-mm5q-2f29-m34g","CGA-mw24-r89w-c6j6","CGA-p2wc-66wx-33r3","CGA-p58r-827r-h83q","CGA-p6w9-3498-fcrf","CGA-pgwx-5rqg-mf75","CGA-phfx-rqfx-8cg3","CGA-pmfc-mhfh-9m6h","CGA-pmw7-cm3m-cg43","CGA-pr5v-r5xj-g7ph","CGA-pxv3-fx8w-ghvv","CGA-q4hg-hh42-2xvg","CGA-q57r-xqwq-hfph","CGA-qxf5-r5jg-vgxg","CGA-r758-vcrg-cx63","CGA-r7hc-6ww5-xc3h","CGA-rgfm-6wgr-9hq5","CGA-v4rr-7933-8598","CGA-v6wg-92qp-7rhc","CGA-vwr9-85j2-2jcv","CGA-w24x-53rp-2hpf","CGA-w93m-fpvq-m4v6","CGA-wgcq-5cp7-9gg6","CGA-wv95-8wp9-59p2","CGA-x2p6-xg7x-h2hx","CGA-x6w8-gjqx-3qv7","CGA-xh9q-j6m4-mv67","CGA-xp2j-h7mw-qf22","CGA-xpjg-r7p6-f947","CGA-xrp3-6664-27gm","CGA-2j37-wq9q-rv78","CGA-3f4v-3jfc-c35r","CGA-5c3x-q9w7-3wqg","CGA-734j-22fg-xqqh","CGA-9359-q8m5-x52h","CGA-c8gp-gfc3-3f87","CGA-cg8p-vwmj-grrm","CGA-ffrr-j5q5-6r2c","CGA-grqg-8r2g-vr3p","CGA-hfg8-hwh9-q5rw","CGA-qfqm-hvgh-hcjm","CGA-v2r9-6rc9-5vqw","CGA-vrw6-cv24-47gc","CGA-xxwf-v9x2-53jv","CGA-3cw7-v993-v3x4","CGA-7gf5-v279-w6qm","CGA-fmw9-f4r2-rg2r","CGA-j8pw-23ff-2j59","CGA-w4g5-wcc6-v5fv","CGA-356f-gvf6-32r6","CGA-57v4-w3r8-c9fq","CGA-6wj9-w3p8-2w78","CGA-gf9m-7xc2-gr2c","CGA-vg55-wqxq-5qj8","BIT-dotnet-2026-96958","BIT-dotnet-sdk-2026-96958","UBUNTU-CVE-2026-96958"],"status":"published","duplicateOf":null,"title":null,"description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.","dates":{"published":"2026-10-13T19:01:27.223Z","modified":"2026-10-19T23:52:06.351Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Nuget","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true}]},"epss":{"probability":0.01033,"percentile":0.6327,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-14T00:00:00.000Z","score":0.01056,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01056,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01056,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01033,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01033,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01033,"percentile":0.6327}],"last30":[{"date":"2026-10-14T00:00:00.000Z","score":0.01056,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01056,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01056,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01033,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01033,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01033,"percentile":0.6327}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-407","name":"Inefficient Algorithmic Complexity","description":"An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Low","url":"https://cwe.mitre.org/data/definitions/407.html"}],"affected":[{"vendor":"chainguard","product":"aspnet-9-targeting-pack","name":"aspnet-9-targeting-pack","label":"aspnet-9-targeting-pack","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/aspnet-9-targeting-pack","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 9.0.122-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 9.0.122-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-10-sdk","name":"dotnet-10-sdk","label":"dotnet-10-sdk","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-10-sdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.113-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.113-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-8-sdk","name":"dotnet-8-sdk","label":"dotnet-8-sdk","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-8-sdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 8.0.132-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 8.0.132-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-9-sdk","name":"dotnet-9-sdk","label":"dotnet-9-sdk","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-9-sdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 9.0.122-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 9.0.122-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-bootstrap-8","name":"dotnet-bootstrap-8","label":"dotnet-bootstrap-8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-bootstrap-8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-bootstrap-9","name":"dotnet-bootstrap-9","label":"dotnet-bootstrap-9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-bootstrap-9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-sdk-10.0.2","name":"dotnet-sdk-10.0.2","label":"dotnet-sdk-10.0.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-sdk-10.0.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.204-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.204-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-sdk-10.0.3","name":"dotnet-sdk-10.0.3","label":"dotnet-sdk-10.0.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-sdk-10.0.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-sdk-10.0.4","name":"dotnet-sdk-10.0.4","label":"dotnet-sdk-10.0.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-sdk-10.0.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.402-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.402-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-sdk-stage0-10","name":"dotnet-sdk-stage0-10","label":"dotnet-sdk-stage0-10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-sdk-stage0-10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.113-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.113-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"promitor","name":"promitor","label":"promitor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/promitor","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.16.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.16.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"aspnet-9-targeting-pack","name":"aspnet-9-targeting-pack","label":"aspnet-9-targeting-pack","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/aspnet-9-targeting-pack","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 9.0.122-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 9.0.122-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-10-sdk","name":"dotnet-10-sdk","label":"dotnet-10-sdk","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-10-sdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.113-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.113-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-8-sdk","name":"dotnet-8-sdk","label":"dotnet-8-sdk","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-8-sdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 8.0.132-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 8.0.132-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-9-sdk","name":"dotnet-9-sdk","label":"dotnet-9-sdk","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-9-sdk","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 9.0.122-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 9.0.122-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-bootstrap-8","name":"dotnet-bootstrap-8","label":"dotnet-bootstrap-8","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-bootstrap-8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-bootstrap-9","name":"dotnet-bootstrap-9","label":"dotnet-bootstrap-9","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-bootstrap-9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-sdk-10.0.2","name":"dotnet-sdk-10.0.2","label":"dotnet-sdk-10.0.2","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-sdk-10.0.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.204-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.204-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-sdk-10.0.3","name":"dotnet-sdk-10.0.3","label":"dotnet-sdk-10.0.3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-sdk-10.0.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-sdk-10.0.4","name":"dotnet-sdk-10.0.4","label":"dotnet-sdk-10.0.4","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-sdk-10.0.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.402-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.402-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-sdk-stage0-10","name":"dotnet-sdk-stage0-10","label":"dotnet-sdk-stage0-10","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-sdk-stage0-10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 10.0.113-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 10.0.113-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"promitor","name":"promitor","label":"promitor","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/promitor","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.16.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.16.1-r1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet10","name":"dotnet10","label":"dotnet10","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet10","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet11","name":"dotnet11","label":"dotnet11","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet11","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet6","name":"dotnet6","label":"dotnet6","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet6","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet7","name":"dotnet7","label":"dotnet7","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet7","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet8","name":"dotnet8","label":"dotnet8","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet8","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"microsoft","product":"microsoft .net framework 3.5","name":"Microsoft .NET Framework 3.5","label":"microsoft .net framework 3.5","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 3.5.0, < 2.0.50727.9188 AND 3.0.30729.9171","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3.5.0, < 2.0.50727.9188 AND 3.0.30729.9171","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_35"},{"vendor":"microsoft","product":"microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2","name":"Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2","label":"microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 3.0.0.0, < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3.0.0.0, < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_35_and_46247471472"},{"vendor":"microsoft","product":"microsoft .net framework 3.5 and 4.7.2","name":"Microsoft .NET Framework 3.5 AND 4.7.2","label":"microsoft .net framework 3.5 and 4.7.2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.7.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.7.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_35_and_472"},{"vendor":"microsoft","product":"microsoft .net framework 3.5 and 4.8","name":"Microsoft .NET Framework 3.5 AND 4.8","label":"microsoft .net framework 3.5 and 4.8","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.8.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.8.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_35_and_48"},{"vendor":"microsoft","product":"microsoft .net framework 3.5 and 4.8.1","name":"Microsoft .NET Framework 3.5 AND 4.8.1","label":"microsoft .net framework 3.5 and 4.8.1","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.8.1, < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.8.1, < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_35_and_481"},{"vendor":"microsoft","product":"microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2","name":"Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2","label":"microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.7.0, < 4.7.4150.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.7.0, < 4.7.4150.0","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_46247471472"},{"vendor":"microsoft","product":"microsoft .net framework 4.8","name":"Microsoft .NET Framework 4.8","label":"microsoft .net framework 4.8","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.8.0, < 4.8.4811.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.8.0, < 4.8.4811.0","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_48"},{"vendor":"microsoft","product":"microsoft .net framework 4.8.1","name":"Microsoft .NET Framework 4.8.1","label":"microsoft .net framework 4.8.1","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.8.0.0, < 4.8.9363.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.8.0.0, < 4.8.9363.0","eol":null,"hubHref":"/vendor/microsoft/microsoft_net_framework_481"},{"vendor":"microsoft","product":".net","name":".net","label":".net","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0.0, < 8.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 10.0.0, < 10.0.13","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:preview1","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:preview2","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:preview3","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:preview4","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:preview5","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:preview6","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:preview7","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0:rc1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.0, < 8.0.5 | ≥ 9.0.0, < 9.0.21 | ≥ 10.0.0, < 10.0.13 | 11.0.0:preview1 | 11.0.0:preview2 | 11.0.0:preview3 | 11.0.0:preview4 | 11.0.0:preview5 | 11.0.0:preview6 | 11.0.0:preview7 | 11.0.0:rc1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"dotnet","label":"Microsoft .NET","category":"framework"}},"hubHref":"/vendor/microsoft/net"},{"vendor":"microsoft","product":".net_framework","name":".net framework","label":".net_framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.8.1","noFixRecorded":false,"fixedIn":null},{"text":"4.8","noFixRecorded":false,"fixedIn":null},{"text":"4.6.2","noFixRecorded":false,"fixedIn":null},{"text":"4.7","noFixRecorded":false,"fixedIn":null},{"text":"4.7.1","noFixRecorded":false,"fixedIn":null},{"text":"4.7.2","noFixRecorded":false,"fixedIn":null},{"text":"3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.8.1 | 4.8 | 4.6.2 | 4.7 | 4.7.1 | 4.7.2 | 3.5","eol":null,"hubHref":"/vendor/microsoft/net_framework"},{"vendor":"microsoft","product":"system.security.cryptography.xml","name":"System.Security.Cryptography.Xml","label":"system.security.cryptography.xml","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 10.0.0, < 10.0.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0, < 10.0.13","eol":null,"hubHref":"/vendor/microsoft/systemsecuritycryptographyxml"},{"vendor":"NuGet","product":"System.Security.Cryptography.Xml","name":"System.Security.Cryptography.Xml","label":"System.Security.Cryptography.Xml","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/System.Security.Cryptography.Xml","purlType":"nuget","versions":[{"text":"≥ 10.0.0, < 10.0.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.0.0-preview.1, < 11.0.0-rc.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0, < 10.0.13 | ≥ 11.0.0-preview.1, < 11.0.0-rc.2 | ≥ 8.0.0, < 8.0.5 | ≥ 9.0.0, < 9.0.21","eol":null,"hubHref":null}],"affectedCount":39,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96958","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96958","hostname":"msrc.microsoft.com","tags":["Vendor Advisory","Patch","WEB","REPORT"]},{"url":"https://github.com/dotnet/runtime/security/advisories/GHSA-r955-8q5j-3h83","label":"github.com/dotnet/runtime/security/advisories/GHSA-r955-8q5j-3h83","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/dotnet/announcements/issues/488","label":"github.com/dotnet/announcements/issues/488","hostname":"github.com","tags":["WEB","REPORT"]},{"url":"https://github.com/dotnet/runtime/issues/135709","label":"github.com/dotnet/runtime/issues/135709","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/dotnet/runtime","label":"github.com/dotnet/runtime","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96958","label":"nvd.nist.gov/vuln/detail/CVE-2026-96958","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-96958","label":"ubuntu.com/security/CVE-2026-96958","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96958","label":"www.cve.org/CVERecord?id=CVE-2026-96958","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-october-2026-servicing-updates","label":"devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-october-2026-servicing-updates","hostname":"devblogs.microsoft.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-13T19:01:27.223Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-19T23:52:06.351Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:16:58.552Z","stale":false,"partial":false}}