CVE-2026-58280

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Recursion in .NET Denial of Service

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-58280

EUVD

EUVD-2026-100324

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	.NET	10.0 10.0.0
Microsoft	.NET	11.0 11.0.0
Microsoft	.NET	8.0 8.0.0
Microsoft	.NET	9.0 9.0.0
Microsoft	Microsoft	.NET Framework 3.5 3.5.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0.0.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.7.2 4.7.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.8 4.8.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.8.1 4.8.1
Microsoft	Microsoft	.NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0
Microsoft	Microsoft	.NET Framework 4.8 4.8.0
Microsoft	Microsoft	.NET Framework 4.8.1 4.8.0.0
Microsoft	Microsoft	Visual Studio 2022 version 17.14 17.14.0
Microsoft	Microsoft	Visual Studio 2026 version 18.10 18.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled recursion in .NET, where an attacker can trigger excessive recursive calls to consume system resources. This leads to a denial of service (DoS) condition over a network, making services unavailable.

Detection Guidance

Detecting uncontrolled recursion in .NET may require monitoring for excessive stack usage or abnormal recursion patterns. Check application logs for stack overflow errors or high CPU usage in .NET processes. Use performance monitoring tools like PerfView or Windows Performance Monitor to track recursion depth and stack exhaustion events.

Impact Analysis

An attacker could exploit this to crash applications or services running on affected .NET versions, causing downtime and disrupting normal operations. Systems may become unresponsive or require a restart.

Compliance Impact

This vulnerability enables denial of service attacks, which could disrupt services handling sensitive data. GDPR requires data protection measures, and HIPAA mandates availability of healthcare systems. A denial of service could violate these requirements by impairing access to critical data.

Mitigation Strategies

Apply the latest security updates from Microsoft for affected .NET versions and frameworks. Monitor network traffic for unusual recursion patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-58280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70