CVE-2026-96959: microsoft microsoft .net framework 3.5
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-c399-9853-6jmjCGA-2353-93jm-r2mpCGA-278h-3v7c-564fCGA-2qgv-xq52-whwvCGA-2r69-gx6w-84wpCGA-2wqh-5fc9-qcrxCGA-2xv6-8456-ff73CGA-3pcx-6cvw-8mpqCGA-3pjm-hcc8-8m8mCGA-4822-jccx-m9v9CGA-4c76-xfg3-x2gvCGA-4hwg-rccj-f358CGA-4p3c-jhqw-vg89CGA-4rx4-g529-5g52CGA-52m9-358m-q983CGA-54hr-v95w-ccfrCGA-5c75-hfg7-55vcCGA-5w6h-g4v4-3cv2CGA-6xq3-65qc-w6mgCGA-72m4-5r73-8h52CGA-7357-f2gx-vrq9CGA-772m-qgqw-2mjwCGA-7cvx-qcjf-6rc9CGA-7mcp-r83m-vphcCGA-7pcx-5rvg-4q22CGA-7q5w-fj79-6gggCGA-868g-63px-2fj6CGA-875m-4rp9-vf47CGA-8c8w-6496-v77xCGA-8fhx-wxfq-5q63CGA-8m78-448v-g44gCGA-8m79-22jv-qjgjCGA-8qwr-vc53-xm5rCGA-8w6x-fj4x-xxj7CGA-8wwm-vw36-xgpcCGA-96vw-w8qr-4rf5CGA-99x8-8v3w-2hqmCGA-9jmg-9r56-mvgrCGA-c499-gwmh-3838CGA-c58x-5qmw-77m3CGA-c5pv-49v7-ghwxCGA-c6wj-qvm6-3fx8CGA-f7mc-j4gv-m62xCGA-f7q5-35wx-x4rwCGA-fh3r-88f6-2f5rCGA-fj53-h425-3fp8CGA-frvh-j78x-h67pCGA-g9hc-fmx2-fpvqCGA-gfwv-45cj-j7xfCGA-ghwr-qgq2-6v7qCGA-gjmr-qrjh-32x3CGA-gwpg-8w9m-h2hhCGA-h6m7-mg85-f686CGA-hj2g-3gf6-8xrcCGA-hmmf-qqmj-xhcmCGA-hv43-84hf-545vCGA-j4hg-4xp2-3m7fCGA-jgg3-hw97-6gcrCGA-jjgv-h6j2-6cpvCGA-m6pj-h44c-pgvfCGA-mfmf-vq3f-7g9mCGA-mrcc-qg6w-5c7hCGA-mrmq-2rjg-2v3hCGA-mwcw-jqvq-vgvfCGA-p3h6-x926-w5cwCGA-p5gr-pg7f-824jCGA-p6qx-vrmc-wr25CGA-pj7f-h8r4-22x3CGA-pmqh-j43v-8cxpCGA-pqhw-r6mq-j45fCGA-pxf6-f2m4-fmr7CGA-q279-3rmq-q47mCGA-q44h-9wwr-m9r4CGA-qhwf-xvpf-qxfhCGA-qw3q-79w9-92pgCGA-qxq2-497j-347xCGA-r574-6f2j-8vhgCGA-r8wj-6f27-jc58CGA-rg2w-r48w-m3q6CGA-rjpw-pj25-48xpCGA-rvfm-mr75-r37vCGA-rx3q-g6xw-q5xcCGA-v3wg-6ch6-8j76CGA-vmpr-3mvm-35r3CGA-wc29-w6q4-2654CGA-wf2m-x5rg-3q87CGA-wg32-xccw-4xv2CGA-wp3w-4283-cxq6CGA-x6hf-g6g2-6q6qCGA-x8p7-cx29-382vCGA-x98p-4p68-2c79CGA-xjxc-jmvx-wrh8CGA-xrr9-3v6g-76h8CGA-xxh8-prfq-fh2vCGA-2p6r-g744-5rj7CGA-454c-h7mw-26r5CGA-5gp9-f9jm-w47mCGA-5x6m-gj55-f3w8CGA-78rj-w386-cp7cCGA-82xc-xqgp-h6c8CGA-9g25-h4hf-8j33CGA-9r2h-hhw2-jxw6CGA-cxv7-4xrw-hj92CGA-hf66-8p9g-jrjjCGA-pr8c-8vw3-rpp7CGA-prvh-c642-jg6wCGA-v74q-655j-v957CGA-xr8v-pfjf-m774CGA-g6v7-f7jq-m935CGA-j25g-h224-5jxfCGA-j499-gq7r-m39cCGA-7hp2-9v4f-pgj8CGA-c4cv-4rjc-9p85CGA-cq49-pq8q-9mhhCGA-rpmq-qxjw-p8jfCGA-x4g2-gvxw-2hwxCGA-x69v-hf39-rqv3BIT-dotnet-2026-96959BIT-dotnet-sdk-2026-96959
Published 13-10-2026Last modified 16-10-2026
Vulnerability summary
CVE-2026-96959 is a high (CVSS 7.5) vulnerability in microsoft microsoft .net framework 3.5. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.75%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 13-10-2026PublishedVulnerability first disclosed.
- 16-10-2026Last modifiedVulnerability information updated.
Description
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:CSourcesAll 5 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
14-10-202619-10-2026
EPSS score0.75%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard11 products
- aspnet-9-targeting-packAll versions (No fix recorded) | < 9.0.122-r0
- dotnet-10-sdkAll versions (No fix recorded) | < 10.0.113-r1
- dotnet-8-sdkAll versions (No fix recorded) | < 8.0.132-r0
- dotnet-9-sdkAll versions (No fix recorded) | < 9.0.122-r0
- dotnet-bootstrap-8All versions (No fix recorded)
Microsoft11 products
- microsoft .net framework 3.5≥ 3.5.0, < 2.0.50727.9188 AND 3.0.30729.9171
- microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2≥ 3.0.0.0, < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
- microsoft .net framework 3.5 and 4.7.2≥ 4.7.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
- microsoft .net framework 3.5 and 4.8≥ 4.8.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
- microsoft .net framework 3.5 and 4.8.1≥ 4.8.1, < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Wolfi11 products
- aspnet-9-targeting-packAll versions (No fix recorded) | < 9.0.122-r0
- dotnet-10-sdkAll versions (No fix recorded) | < 10.0.113-r1
- dotnet-8-sdkAll versions (No fix recorded) | < 8.0.132-r0
- dotnet-9-sdkAll versions (No fix recorded) | < 9.0.122-r0
- dotnet-bootstrap-8All versions (No fix recorded)
NuGet1 product
- System.Security.Cryptography.Xml≥ 10.0.0, < 10.0.13 | ≥ 11.0.0-preview.1, < 11.0.0-rc.2 | ≥ 8.0.0, < 8.0.5 | ≥ 9.0.0, < 9.0.21
4 vendors · 34 products
References
5 links
- github.com/dotnet/runtimePACKAGE