CVE-2026-57108

.NET Denial of Service Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Description

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

Analysis

Technical impact

A type‑confusion flaw in .NET Core permits an attacker to trigger a denial‑of‑service condition by sending specially crafted data over the network. The incompatible type, resulting in an exception that may to legitimate users.

Affected Systems

The flaw affects Microsoft .NET 10.0, .NET 9.0, and .NET 8.0. Any installation of these runtimes that processes untrusted network data is potentially vulnerable; the exact patch level is not specified in the input, but the advisory references a security update for all listed versions.

Risk and Exploitability

With a CVSS score of 7.5 and an EPSS probability of 0.01105 (~1.11 %), the risk of exploitation is moderate but present. The vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation yet. Based on the description it is inferred that an unauthorized attacker can exploit the sending exploitation would cause application crashes or hangs, leading to service interruption for affected users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

.NET 10.0 runtime

affected

Version	Status	Constraints
`10.0.0`	affected	< 10.0.10

Microsoft

.NET 8.0 runtime

affected

Version	Status	Constraints
`8.0.0`	affected	< 8.0.29

Microsoft

.NET 9.0 runtime

affected

Version	Status	Constraints
`9.0.0`	affected	< 9.0.18

Configuration 1 [-]

AND

OR	cpe:2.3:a:microsoft:.net::::::::
	cpe:2.3:a:microsoft:.net::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*

Package	CPE	Advisory	Released Date
Red Hat Hardened Images
dotnet10-0-main-10.0.109-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:26638	2026-06-17T00:00:00Z
dotnet9-0-main-9.0.118-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:27171	2026-06-19T00:00:00Z

Vendor Product Versions

Microsoft

.net

Version	Status	Scheme	Platform
`[10.0.0,10.0.6)`	affected	semver	—

Microsoft

.net

Version	Status	Scheme	Platform
`[8.0.0,8.0.29)`	affected	semver	—

Microsoft

.net

Version	Status	Scheme	Platform
`[9.0.0,9.0.18)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Microsoft .NET security update for the affected version, as referenced in the Microsoft Security Response Center advisory.
If patching cannot be performed immediately, restrict external network access to the application or service so that only trusted traffic can reach the vulnerable component, reducing the likelihood of a successful denial‑of‑service attack.
Implement application monitoring and graceful handling of anomalous resource access to detect and mitigate crashes caused by type‑confusion errors.

Generated by OpenCVE AI on July 31, 2026 at 06:18 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rp2p-6cmp-jxj9	Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
Ubuntu USN	USN-8553-1	.NET vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.2% (1.174% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108
https://nvd.nist.gov/vuln/detail/CVE-2026-57108
https://www.cve.org/CVERecord?id=CVE-2026-57108

History

Jul 18, 2026 12:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat hummingbird
CPEs		cpe:/a:redhat:hummingbird:1
Vendors & Products		Redhat Redhat hummingbird
References		https://nvd.nist.gov/vuln/detail/CVE-2026-57108 https://www.cve.org/CVERecord?id=CVE-2026-57108
Metrics	threat_severity `None`	threat_severity `Important`

Jul 14, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
Title		.NET Denial of Service Vulnerability
First Time appeared		Microsoft Microsoft .net
Weaknesses		CWE-843
CPEs		cpe:2.3:a:microsoft:.net::::::::
Vendors & Products		Microsoft Microsoft .net
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}`