CVE-2026-47302: .NET DOS Vulnerability

CVE-2026-47302 Overview

CVE-2026-47302 is a denial of service vulnerability in Microsoft .NET caused by allocation of resources without limits or throttling [CWE-770]. An unauthorized attacker can send crafted network requests that force the affected .NET runtime or library to consume excessive resources. The condition results in service unavailability without requiring authentication or user interaction.

The issue is exploitable over the network with low attack complexity. Microsoft published guidance for this vulnerability through the Microsoft Security Response Center on July 14, 2026.

Critical Impact
Remote unauthenticated attackers can exhaust resources on .NET-based services, causing full availability loss for hosted applications and APIs.

Affected Products

Microsoft .NET (see the Microsoft Security Update CVE-2026-47302 for the authoritative list of affected versions)
Applications and services built on affected .NET runtimes
ASP.NET-hosted APIs and web workloads exposed to untrusted network input

Discovery Timeline

2026-07-14 - CVE CVE-2026-47302 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-47302

Vulnerability Analysis

The vulnerability is classified under [CWE-770] Allocation of Resources Without Limits or Throttling. Affected .NET components accept network input and allocate memory, threads, or other resources without enforcing an upper bound. Attackers exploit this behavior by submitting requests that scale server-side resource consumption.

Because the flaw affects availability only, it does not leak data or permit code execution. However, unauthenticated attackers can repeatedly trigger the condition to keep affected services offline. The impact extends to any downstream application that depends on the affected .NET process.

Root Cause

The root cause is missing input-driven resource caps in an affected .NET code path. When the runtime processes attacker-controlled data, it allocates buffers, connections, or worker resources proportional to the input without validating aggregate limits. Refer to the Microsoft Security Update CVE-2026-47302 advisory for component-level details.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends specifically crafted requests to a network endpoint served by an affected .NET application. Sustained requests exhaust CPU, memory, or thread pool capacity until the service stops responding.

A public proof of concept is not available, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog. The EPSS probability at publication was 0.814%.

Detection Methods for CVE-2026-47302

Indicators of Compromise

Sudden spikes in memory, thread count, or CPU utilization on .NET worker processes without a matching increase in legitimate request volume
Repeated requests from a single source or small set of sources targeting a specific endpoint with abnormal payload sizes
Application pool recycles, OutOfMemoryException entries, or unresponsive health probes in .NET service logs

Detection Strategies

Baseline normal request rates and payload sizes for public .NET endpoints, then alert on statistically significant deviations
Correlate web server access logs with process telemetry to identify requests that precede resource exhaustion
Monitor .NET runtime performance counters, including # Bytes in all Heaps, ThreadPool Thread Count, and request queue length

Monitoring Recommendations

Forward IIS, Kestrel, and application logs to a centralized analytics platform for rate and anomaly analysis
Enable Application Insights or equivalent APM tracing on ASP.NET workloads to capture per-request resource consumption
Configure alerting on worker process restarts and unhandled exceptions tied to memory or thread saturation

How to Mitigate CVE-2026-47302

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-47302 advisory to all affected .NET runtimes and SDKs
Inventory hosts running .NET workloads and prioritize internet-facing services for patching first
Restart affected application pools and services after patching to load the fixed runtime

Patch Information

Microsoft has released updates for affected .NET versions. Consult the Microsoft Security Update CVE-2026-47302 for the current list of fixed builds and installation instructions across .NET runtime channels.

Workarounds

Place a rate-limiting reverse proxy or web application firewall in front of exposed .NET endpoints to cap request volume per source
Enforce maximum request body size and connection limits at the web server tier (maxAllowedContentLength, Kestrel Limits.MaxRequestBodySize)
Restrict network exposure of non-public .NET services to trusted management networks until patches are deployed

bash

# Configuration example - Kestrel request limits in appsettings.json
{
  "Kestrel": {
    "Limits": {
      "MaxRequestBodySize": 1048576,
      "MaxConcurrentConnections": 1000,
      "MaxConcurrentUpgradedConnections": 100,
      "KeepAliveTimeout": "00:02:00",
      "RequestHeadersTimeout": "00:00:30"
    }
  }
}