CVE-2026-26127

Microsoft Security Advisory CVE-2026-26127 – .NET Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/384

CVSS Details

• Version: 3.1
• Score: 7.5
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
• Severity: High
• Weakness: CWE-129 (Improper Validation of Array Index); CWE-125 (Out-of-bounds Read)

Affected Platforms

• Platforms: All
• Architectures: All

Affected Products

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.NetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.13 | 9.0.14

<a name=".NET 10"></a>.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.3 | 10.0.4 Microsoft.NetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.3 | 10.0.4 Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.3 | 10.0.4 Microsoft.NetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.3 | 10.0.4 Microsoft.NetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.3 | 10.0.4…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-73j8-2gch-69rq. This link is maintained to preserve external references.

Original Description

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

It was discovered that the .NET Microsoft.Bcl.Memory NuGet package did not properly handle certain malformed Base64Url encoded input. An attacker could possibly use this issue to cause .NET to crash, resulting in a denial of service. This issue only affected .NET 9.0 and .NET 10.0. (CVE-2026-26127)

Bartłomiej Dach discovered that .NET's SignalR server component did not properly manage resource consumption when processing certain messages. An attacker could possibly use this issue to exhaust internal buffers, resulting in a denial of service. (CVE-2026-26130)