Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-96958: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

52
This month
HIGH 7.5REMOTEWATCHLISTUPGRADEDOWNGRADE

CVE-2026-96958 is a high-severity flaw (CVSS 7.5) affecting .net, .net framework. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Why this priority

  • High severity
  • Remotely exploitable, no login, no user action
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance1.0% (top 36%)
CISA exploited listNo
WeaknessCWE-407
Published2026-10-13
Last modified2026-10-22
Publisher (CNA): Microsoft Corporation · Vendor: microsoft

Am I affected?

Timeline

microsoft .net UPGRADE
Affected: >= 8.0.0 and < 8.0.5 · >= 9.0.0 and < 9.0.21 · >= 10.0.0 and < 10.0.13 · 11.0.0 preview1 · 11.0.0 preview2 · 11.0.0 preview3 · 11.0.0 preview4 · 11.0.0 preview5
Fixed in: 8.0.5, 9.0.21, 10.0.13
Safe to downgrade to: a release before 8.0.0
1. Check installed version
apt-cache policy .net || rpm -q .net || .net --version
2. UPGRADE to 8.0.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade .net
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade .net
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 8.0.0 (Debian / Ubuntu)
apt-cache madison .net sudo apt install .net=<VERSION_BEFORE_8.0.0> sudo apt-mark hold .net
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list .net sudo dnf downgrade .net-<VERSION_BEFORE_8.0.0> sudo dnf versionlock add .net
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft .net framework DOWNGRADE
Affected: 4.8.1 · 4.8 · 4.6.2 · 4.7 · 4.7.1 · 4.7.2 · 3.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.5
1. Check installed version
apt-cache policy .net-framework || rpm -q .net-framework || .net-framework --version
2. No fixed release: DOWNGRADE to a release before 3.5 (Debian / Ubuntu)
apt-cache madison .net-framework sudo apt install .net-framework=<VERSION_BEFORE_3.5> sudo apt-mark hold .net-framework
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list .net-framework sudo dnf downgrade .net-framework-<VERSION_BEFORE_3.5> sudo dnf versionlock add .net-framework
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.
NuGet (.NET) · System.Security.Cryptography.Xml · FIXED · 10.0.13 · vulnerable: >= 10.0.0, <= 10.0.12 · source
dotnet add package System.Security.Cryptography.Xml --version 10.0.13
Fedora 46 · python-streamlink · FIXED · 8.6.2-1.fc46 · FEDORA-2026-a56fcfdc08 · source
sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08
Fedora ELN · valgrind · FIXED · 3.28.0-1.eln159 · FEDORA-2026-c593ef1d15 · source
sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15
Ubuntu 22.04 · dotnet6 · DEFERRED
Ubuntu 22.04 · dotnet8 · FIXED · 8.0.132-8.0.32-0ubuntu1~22.04.1
sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.132-8.0.32-0ubuntu1~22.04.1" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · dotnet8 · FIXED · 8.0.132-8.0.32-0ubuntu1~24.04.1
sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.132-8.0.32-0ubuntu1~24.04.1" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · dotnet10 · FIXED · 10.0.113-10.0.13-0ubuntu1~24.04.1
sudo apt update && sudo apt install --only-upgrade dotnet10 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet10)" ge "10.0.113-10.0.13-0ubuntu1~24.04.1" && echo PATCHED || echo STILL-VULNERABLE
Alpine 3.22 · dotnet8-runtime · FIXED · dotnet8-runtime-8.0.32-r0
apk add --upgrade dotnet8-runtime apk info -v dotnet8-runtime
Alpine 3.22 · dotnet9-runtime · FIXED · dotnet9-runtime-9.0.21-r0
apk add --upgrade dotnet9-runtime apk info -v dotnet9-runtime
Alpine 3.23 · dotnet10-runtime · FIXED · dotnet10-runtime-10.0.13-r0
apk add --upgrade dotnet10-runtime apk info -v dotnet10-runtime
Alpine 3.23 · dotnet8-runtime · FIXED · dotnet8-runtime-8.0.32-r0
apk add --upgrade dotnet8-runtime apk info -v dotnet8-runtime
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2 · KB5127689 · FIXED · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 · KB5127689 · source
Install KB5127689 via Windows Update, then verify: Get-HotFix -Id KB5127689
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2 · KB5127689 · FIXED · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 · KB5127689 · source
Install KB5127689 via Windows Update, then verify: Get-HotFix -Id KB5127689
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2 · KB5127690 · FIXED · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 · KB5127690 · source
Install KB5127690 via Windows Update, then verify: Get-HotFix -Id KB5127690
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2 · KB5127690 · FIXED · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 · KB5127690 · source
Install KB5127690 via Windows Update, then verify: Get-HotFix -Id KB5127690
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 · KB5127690 · FIXED · 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 · KB5127690 · source
Install KB5127690 via Windows Update, then verify: Get-HotFix -Id KB5127690
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs