Description
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Published: 2026-07-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is an unbounded resource allocation flaw in the .NET runtime. Allocation of resources without limits or throttling allows an unauthorized attacker to request large amounts of memory, exhausting system resources and leading to a denial of service over a network. The flaw is classified as CWE-770, Resource Exhaustion.

Affected Systems

Microsoft .NET Framework versions 8.0, 9.0, and 10.0 are affected, along with Microsoft Visual Studio 2022 versions 17.12 and 17.14, and Microsoft Visual Studio 2026 version 18.7. All of these products are impacted by the unbounded allocation behavior.

Risk and Exploitability

The CVSS score of 7.5 places this flaw in the high‑moderate severity range, while the EPSS score of less than 1% indicates that exploitation is expected to be infrequent. The flaw is not listed in CISA's KEV catalog. Attackers would need to deliver a crafted request over a network to the vulnerable .NET application or service, and then repeatedly trigger large allocations until the system runs out of memory or the process is killed, resulting in a denial of service.

Generated by OpenCVE AI on July 31, 2026 at 05:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Microsoft .NET runtime update for affected versions (8.0, 9.0, and 10.0) to address the unbounded allocation flaw.
  • Install the newest Microsoft Visual Studio 2022 updates that incorporate the .NET runtime patch, and apply the Visual Studio 2026 update once released.
  • Configure operating‑system or application‑level resource limits, such as setting memory quotas or using process isolation, to cap the memory usage of the affected applications and mitigate potential denial‑of‑service incidents.

Generated by OpenCVE AI on July 31, 2026 at 05:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-wp74-jgxh-gv4q Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
Ubuntu USN Ubuntu USN USN-8553-1 .NET vulnerabilities
History

Wed, 15 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 14 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Title .NET Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
Weaknesses CWE-770
CPEs cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft .net Visual Studio 2022 Visual Studio 2026
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-08-03T22:56:28.235Z

Reserved: 2026-06-05T14:33:50.830Z

Link: CVE-2026-50651

cve-icon Vulnrichment

Updated: 2026-07-14T20:39:41.548Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-14T21:37:42Z

Links: CVE-2026-50651 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T05:30:07Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling