Description
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.
The update addresses the vulnerability by correcting how the .NET web application handles web requests.
Published: 2026-10-13
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker can cause a denial of service against a .NET web application by issuing specially crafted requests. This vulnerability is characterized by uncontrolled resource consumption and resource exhaustion, documented as CWE-405 and CWE-770.

Affected Systems

This issue affects Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10, as well as the System.Security.Cryptography.Pkcs package. The affected components are part of the Microsoft Common Object Runtime Library used in .NET web applications.

Risk and Exploitability

The CVSS score of 5.9 indicates medium severity. The EPSS score is less than 1%, and it is not listed in the CISA KEV catalog. A remote, unauthenticated attacker could exploit the flaw by sending crafted requests to a vulnerable .NET application. Because the attack requires only network access to the application, immediate patching is recommended to prevent service disruption.

Generated by OpenCVE AI on October 22, 2026 at 23:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Microsoft update that corrects the handling of web requests in the .NET application, as documented in the MSRC advisory.
  • Implement rate limiting or web application firewall rules to restrict the volume of incoming requests to the .NET service as a temporary countermeasure.
  • Monitor application logs and performance metrics for sudden spikes in resource usage or request frequency that may indicate an exploitation attempt.

Generated by OpenCVE AI on October 22, 2026 at 23:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2fmv-rv2c-59x7 Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
History

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-770
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 14 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.
Title .NET Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft system.security.cryptography.pkcs
Microsoft visual Studio 2022
Weaknesses CWE-405
CPEs cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:system.security.cryptography.pkcs:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft system.security.cryptography.pkcs
Microsoft visual Studio 2022
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Microsoft Visual Studio 2026 Version 18.10 System.security.cryptography.pkcs Visual Studio 2022
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:12:55.805Z

Reserved: 2026-08-03T23:36:51.174Z

Link: CVE-2026-70162

cve-icon Vulnrichment

Updated: 2026-10-13T22:12:04.581Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:19:29.803

Modified: 2026-10-22T22:18:32.663

Link: CVE-2026-70162

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-13T19:01:37Z

Links: CVE-2026-70162 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:15:13Z

Weaknesses
  • CWE-405

    Asymmetric Resource Consumption (Amplification)

  • CWE-770

    Allocation of Resources Without Limits or Throttling