CVE-2026-42899
HighCVSS 7.5Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A vulnerability in ASP.NET Core causes an infinite loop, which can be exploited by an unauthorized attacker to perform a Denial of Service (DoS) attack over the network.
Risk Assessment
An attacker can remotely overload the server, causing application unavailability for legitimate users, leading to service disruptions and potential financial losses.
Recommendation
Immediately update ASP.NET Core to the latest version containing the security fix and monitor systems for unusual network load.
Other vulnerabilities in ASP.NET Core
See all- CVE-2017-11879High
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.
- CVE-2017-0249High
An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.
- CVE-2026-40372Critical
A vulnerability in ASP.NET Core due to improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.
- CVE-2020-1161High
Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.
- CVE-2026-47303High
ASP.NET Core has an authentication bypass vulnerability due to assumed-immutable data. This allows an authorized attacker to elevate privileges over a network.
- CVE-2026-47300High
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- CVE-2026-56170High
Resource allocation without limits in ASP.NET Core allows an unauthorized attacker to perform a DoS attack over the network.
- CVE-2026-50506High
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVE-2026-45646High
A vulnerability in ASP.NET Core allows an unauthorized attacker to perform a Denial of Service (DoS) attack by allocating resources without limits or throttling. The attack can be carried out remotely over a network.
- CVE-2026-45591High
In ASP.NET Core, uncontrolled resource consumption allows an unauthorized attacker to perform a denial of service attack over a network.
Original NVD description (English source)
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.