Every CVESearch/Get API key

CVE-2026-120796

.NET Denial of Service Vulnerability

5.3 MediumFix available

CVE-2026-120796 is a medium vulnerability (CVSS 5.3) in Microsoft .net 11.0 Installed On Linux, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in Microsoft.NETCore.App.Runtime.linux-arm 11.0.0.

What does this mean?
Severity
5.3 MediumCVSS 3.1, CVE List
Exploit chance
1.17%EPSS, 67th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
11.0.0Microsoft.NETCore.App.Runtime.linux-arm +31 more

Description

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.17%Unchanged since Nov 11, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
Microsoft.NETCore.App.Runtime.linux-arm
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.linux-arm64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-arm
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-arm64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-x64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.linux-x64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.osx-arm64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.osx-x64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.win-arm64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.win-x64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Show 22 moreShow less
Affected packages
PackageAffectedFixed
Microsoft.NETCore.App.Runtime.win-x86
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
System.Text.Json
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.NETCore.App.Runtime.linux-arm
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.linux-arm64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-arm
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-arm64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-x64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.linux-x64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.osx-arm64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.osx-x64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.win-arm64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.win-x64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.NETCore.App.Runtime.win-x86
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
System.Text.Json
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
dotnet7
Ubuntu:22.04:LTS
All versions, plus listed versions
7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1
Show 9 moreShow less
7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1
None known
dotnet11
Ubuntu:26.10
before 11.0.100-11.0.0-0ubuntu1~26.10.1, plus listed versions
11.0.100-11.0.0~rc1-0ubuntu111.0.100-11.0.0~rc2-0ubuntu1~26.10.111.0.100-11.0.0~rc3-0ubuntu1~26.10.1
11.0.100-11.0.0-0ubuntu1~26.10.1
dotnet8
Ubuntu:22.04:LTS
From an advisory covering 15 CVEs
before 8.0.134-8.0.34-0ubuntu1~22.04.1, plus listed versions
8.0.102-8.0.2-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.28.0.105-8.0.5-0ubuntu1~22.04.18.0.107-8.0.7-0ubuntu1~22.04.1
Show 24 moreShow less
8.0.108-8.0.8-0ubuntu1~22.04.18.0.110-8.0.10-0ubuntu1~22.04.18.0.111-8.0.11-0ubuntu1~22.04.18.0.112-8.0.12-0ubuntu1~22.04.18.0.114-8.0.14-0ubuntu1~22.04.18.0.115-8.0.15-0ubuntu1~22.04.18.0.116-8.0.16-0ubuntu1~22.04.18.0.117-8.0.17-0ubuntu1~22.04.18.0.118-8.0.18-0ubuntu1~22.04.18.0.119-8.0.19-0ubuntu1~22.04.18.0.120-8.0.20-0ubuntu1~22.04.18.0.121-8.0.21-0ubuntu1~22.04.18.0.122-8.0.22-0ubuntu1~22.04.18.0.123-8.0.23-0ubuntu1~22.04.18.0.124-8.0.24-0ubuntu1~22.04.18.0.125-8.0.25-0ubuntu1~22.04.18.0.126-8.0.26-0ubuntu1~22.04.18.0.127-8.0.27-0ubuntu1~22.04.18.0.128-8.0.28-0ubuntu1~22.04.18.0.129-8.0.29-0ubuntu1~22.04.18.0.130-8.0.30-0ubuntu1~22.04.18.0.131-8.0.31-0ubuntu1~22.04.18.0.132-8.0.32-0ubuntu1~22.04.18.0.133-8.0.33-0ubuntu1~22.04.1
8.0.134-8.0.34-0ubuntu1~22.04.1
dotnet10
Ubuntu:24.04:LTS
From an advisory covering 15 CVEs
before 10.0.115-10.0.15-0ubuntu1~24.04.1, plus listed versions
10.0.100-10.0.0-0ubuntu1~24.04.110.0.101-10.0.1-0ubuntu1~24.04.210.0.103-10.0.3-0ubuntu1~24.04.110.0.104-10.0.4-0ubuntu1~24.04.110.0.105-10.0.5-0ubuntu1~24.04.1
Show 9 moreShow less
10.0.106-10.0.6-0ubuntu1~24.04.110.0.107-10.0.7-0ubuntu1~24.04.110.0.108-10.0.8-0ubuntu1~24.04.110.0.109-10.0.9-0ubuntu1~24.04.110.0.110-10.0.10-0ubuntu1~24.04.110.0.111-10.0.11-0ubuntu1~24.04.110.0.112-10.0.12-0ubuntu1~24.04.110.0.113-10.0.13-0ubuntu1~24.04.110.0.114-10.0.14-0ubuntu1~24.04.1
10.0.115-10.0.15-0ubuntu1~24.04.1
dotnet8
Ubuntu:24.04:LTS
From an advisory covering 15 CVEs
before 8.0.134-8.0.34-0ubuntu1~24.04.1, plus listed versions
8.0.100-8.0.0~rc1-0ubuntu18.0.100-8.0.0~rc2-0ubuntu18.0.100-8.0.0~rc2-0ubuntu28.0.100-8.0.0-0ubuntu18.0.100-8.0.0-0ubuntu2
Show 33 moreShow less
8.0.101-8.0.1-0ubuntu18.0.101-8.0.1-0ubuntu28.0.102-8.0.2-0ubuntu18.0.103-8.0.3-0ubuntu28.0.103-8.0.3-0ubuntu38.0.104-8.0.4-0ubuntu18.0.105-8.0.5-0ubuntu1~24.04.18.0.107-8.0.7-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.28.0.110-8.0.10-0ubuntu1~24.04.18.0.111-8.0.11-0ubuntu1~24.04.18.0.112-8.0.12-0ubuntu1~24.04.18.0.114-8.0.14-0ubuntu1~24.04.18.0.115-8.0.15-0ubuntu1~24.04.18.0.116-8.0.16-0ubuntu1~24.04.18.0.117-8.0.17-0ubuntu1~24.04.18.0.118-8.0.18-0ubuntu1~24.04.18.0.119-8.0.19-0ubuntu1~24.04.18.0.120-8.0.20-0ubuntu1~24.04.18.0.121-8.0.21-0ubuntu1~24.04.18.0.122-8.0.22-0ubuntu1~24.04.18.0.123-8.0.23-0ubuntu1~24.04.18.0.124-8.0.24-0ubuntu1~24.04.18.0.125-8.0.25-0ubuntu1~24.04.18.0.126-8.0.26-0ubuntu1~24.04.18.0.127-8.0.27-0ubuntu1~24.04.18.0.128-8.0.28-0ubuntu1~24.04.18.0.129-8.0.29-0ubuntu1~24.04.18.0.130-8.0.30-0ubuntu1~24.04.18.0.131-8.0.31-0ubuntu1~24.04.18.0.132-8.0.32-0ubuntu1~24.04.18.0.133-8.0.33-0ubuntu1~24.04.1
8.0.134-8.0.34-0ubuntu1~24.04.1
dotnet10
Ubuntu:26.10
From an advisory covering 15 CVEs
before 10.0.115-10.0.15-0ubuntu1~26.10.1, plus listed versions
10.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu110.0.109-10.0.9-0ubuntu110.0.110-10.0.10-0ubuntu3
Show 5 moreShow less
10.0.111-10.0.11-0ubuntu110.0.112-10.0.12-0ubuntu110.0.112-10.0.12-0ubuntu210.0.113-10.0.13-0ubuntu1~26.10.110.0.114-10.0.14-0ubuntu1~26.10.1
10.0.115-10.0.15-0ubuntu1~26.10.1
dotnet11
Ubuntu:26.10
From an advisory covering 15 CVEs
before 11.0.100-11.0.0-0ubuntu1~26.10.1, plus listed versions
11.0.100-11.0.0~rc1-0ubuntu111.0.100-11.0.0~rc2-0ubuntu1~26.10.111.0.100-11.0.0~rc3-0ubuntu1~26.10.1
11.0.100-11.0.0-0ubuntu1~26.10.1
dotnet10
Ubuntu:26.04:LTS
From an advisory covering 15 CVEs
before 10.0.115-10.0.15-0ubuntu1~26.04.1, plus listed versions
10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu110.0.100-10.0.0-0ubuntu110.0.100-10.0.0-0ubuntu210.0.101-10.0.1-0ubuntu1
Show 14 moreShow less
10.0.101-10.0.1-0ubuntu210.0.101-10.0.1-0ubuntu310.0.102-10.0.2-0ubuntu110.0.103-10.0.3-0ubuntu110.0.104-10.0.4-0ubuntu110.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1~26.04.110.0.109-10.0.9-0ubuntu1~26.04.110.0.110-10.0.10-0ubuntu1~26.04.110.0.111-10.0.11-0ubuntu1~26.04.110.0.112-10.0.12-0ubuntu1~26.04.110.0.113-10.0.13-0ubuntu1~26.04.110.0.114-10.0.14-0ubuntu1~26.04.1
10.0.115-10.0.15-0ubuntu1~26.04.1

What each source reports

CVE List Score used5.3

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Record
CVE-2026-120796
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Weakness
CWE-407
Updated
2026-11-10
EUVDEUVD-2026-1224695.3

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Record
EUVD-2026-122469
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Updated
2026-11-11
GitHub AdvisoriesGHSA-cpw3-h88j-9f6x4.6

Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/499

CVSS Details

  • Version: 3.1
  • Severity: Medium
  • Score: 5.3 (base score)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
  • Weakness: CWE-407

Affected Platforms

  • Platforms: Windows, Linux, macOS
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Standalone System.Text.Json delivery

Package | Affected version | Patched version --- | --- | --- System.Text.Json | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential…

Record
GHSA-cpw3-h88j-9f6x
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Weakness
CWE-407
Updated
2026-11-10
NVD5.3

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Record
CVE-2026-120796
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-407
Updated
2026-11-11
OSVGHSA-cpw3-h88j-9f6x5.3

Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/499

CVSS Details

  • Version: 3.1
  • Severity: Medium
  • Score: 5.3 (base score)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
  • Weakness: CWE-407

Affected Platforms

  • Platforms: Windows, Linux, macOS
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Standalone System.Text.Json delivery

Package | Affected version | Patched version --- | --- | --- System.Text.Json | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential…

Record
GHSA-cpw3-h88j-9f6x
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Weakness
CWE-407
Updated
2026-11-10
OSVUBUNTU-CVE-2026-1207965.3

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Record
UBUNTU-CVE-2026-120796
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-12
OSVUSN-9042-1No score

dotnet8, dotnet10, dotnet11 vulnerabilities

Multiple security issues were discovered in .NET and this update includes new upstream .NET versions to fix these issues.

.NET 8 has been updated to 8.0.34 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. .NET 10 has been updated to 10.0.15 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. .NET 11 has been updated to 11.0.0 in Ubuntu 26.10.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Record
USN-9042-1
Updated
2026-11-12

History

History
RecordedChangedSources
affected, aliases, published, referencesNVD, OSV
publishedEUVD
publishedEUVD
affected, referencesOSV
affected, aliases, facts, referencesGitHub Advisories, NVD
cwes, references, severity, titleCVE List
first indexedEUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 20 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open