CVE-2026-96959

Analyzed Analyzed - Analysis Complete

Resource Exhaustion Vulnerability in .NET Framework

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96959

EUVD

EUVD-2026-100280

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	.net	From 8.0.0 (inc) to 8.0.5 (exc)
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	From 9.0.0 (inc) to 9.0.21 (exc)
microsoft	.net	From 10.0.0 (inc) to 10.0.13 (exc)
microsoft	.net_framework	4.8.1
microsoft	.net_framework	4.8
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in .NET where an attacker can exploit unchecked resource allocation to exhaust system resources over a network without authentication.

Detection Guidance

Monitor for unusual resource consumption in .NET applications, such as high CPU or memory usage. Check for network-based denial of service attempts targeting .NET services. Use tools like netstat, perfmon, or application-specific logging to detect abnormal traffic patterns or resource exhaustion.

Impact Analysis

An attacker could make systems unresponsive by consuming excessive resources, leading to service disruptions for legitimate users.

Compliance Impact

This vulnerability allows denial of service attacks, which could disrupt services handling sensitive data. GDPR requires ensuring availability of personal data processing systems, so such disruptions may violate Article 32. HIPAA requires safeguards against service disruptions that could affect protected health information access.

Mitigation Strategies

Apply the latest security updates from Microsoft to patch the affected .NET Framework versions. Monitor network traffic for unusual patterns indicating resource exhaustion attempts.

Hi! I’m here to help you understand CVE-2026-96959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70