Description
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Published: 2026-07-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the .NET runtime’s lack of limits or throttling when allocating resources. An attacker can trigger uncontrolled memory or CPU consumption by sending specially crafted requests to a vulnerable application, consuming available system resources and disabling legitimate processing, which results in a denial of service. This flaw is classified as CWE-770, indicating excessive resource consumption.

Affected Systems

The flaw impacts the Microsoft .NET runtime series, including .NET 10.0, .NET 8.0, and .NET 9.0, as well as several .NET Framework releases (3.5 through 4.8.1). Additionally, Visual Studio 2022 versions 17.12, 17.14, and the upcoming Visual Studio 2026 release 18.7 are affected, as they embed the vulnerable runtime libraries.

Risk and Exploitability

The CVSS score of 7.5 signals a moderate‑to‑high severity. The EPSS score of less than 1% indicates that exploitation is currently rare, and the flaw is not listed in CISA’s KEV catalog. The attack vector is presumed to be network‑based: an unauthenticated remote attacker introduces crafted payloads to a vulnerable application, leading to resource exhaustion that renders the service unavailable.

Generated by OpenCVE AI on July 31, 2026 at 05:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and install the latest Microsoft security update that addresses CVE-2026-50525 for the affected .NET runtime and .NET Framework versions via the Microsoft Security Update Guide.
  • Apply any cumulative security updates for Visual Studio 2022 (at least version 17.14) and Visual Studio 2026 (at least 18.7) that include the fix.
  • If a patch cannot be applied immediately, configure application‑level resource limits or enable OS‑level memory quotas to throttle allocation and prevent exhaustion.
  • Consider implementing network‑level rate limiting or traffic filtering to reduce the frequency of requests that could trigger the vulnerability while awaiting an official patch.

Generated by OpenCVE AI on July 31, 2026 at 05:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8q5v-6pqq-x66h Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
Ubuntu USN Ubuntu USN USN-8553-1 .NET vulnerabilities
History

Wed, 22 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft .net Framework
CPEs cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
Vendors & Products Microsoft .net Framework

Sat, 18 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 14 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Title .NET Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
Weaknesses CWE-770
CPEs cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft .net .net Framework Visual Studio 2022 Visual Studio 2026
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-30T20:25:33.934Z

Reserved: 2026-06-04T19:00:41.293Z

Link: CVE-2026-50525

cve-icon Vulnrichment

Updated: 2026-07-14T20:39:45.733Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-14T19:29:54Z

Links: CVE-2026-50525 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T05:45:03Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling