CVE-2026-62901: .NET DOS Vulnerability

CVE-2026-62901 Overview

CVE-2026-62901 is a denial-of-service vulnerability in Microsoft .NET caused by an unchecked input controlling a loop condition [CWE-606]. An unauthorized remote attacker can send crafted input that forces the affected .NET runtime or component into excessive iteration, exhausting CPU or memory resources. The flaw requires no authentication and no user interaction, and it is exploitable over a network. Microsoft published the advisory on August 11, 2026, and the National Vulnerability Database updated the entry on August 12, 2026. See the Microsoft CVE-2026-62901 Advisory for vendor details.

Critical Impact
Remote, unauthenticated attackers can trigger service-wide denial of service against .NET applications by submitting input that drives an unchecked loop, disrupting availability of dependent workloads.

Affected Products

Microsoft .NET (versions listed in the Microsoft advisory)
ASP.NET Core applications built on affected .NET runtimes
Services and APIs hosted on affected .NET versions

Discovery Timeline

2026-08-11 - CVE-2026-62901 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62901

Vulnerability Analysis

The vulnerability is categorized under [CWE-606], Unchecked Input for Loop Condition. A .NET component reads attacker-controlled input and uses that value directly to control loop iteration without validating an upper bound. When the input is large or crafted, the loop runs far longer than intended and consumes CPU, memory, or thread resources on the host process.

The attack is exploitable over the network without authentication or user interaction. Only availability is affected; there is no impact to confidentiality or integrity. Successful exploitation can degrade or halt any service that processes untrusted input through the affected code path, including web APIs, backend services, and multi-tenant workloads sharing a runtime.

EPSS scoring places the probability of near-term exploitation at 1.08%. No public proof-of-concept, exploit code, or in-the-wild activity has been reported at the time of publication.

Root Cause

The root cause is missing validation of an externally supplied value that drives loop control. The affected code trusts the input to represent a reasonable iteration count, length, or terminating condition. Without a sanity check or maximum bound, an attacker can supply values that force pathological execution time or memory allocation inside the loop body.

Attack Vector

An attacker sends a single crafted network request to an endpoint that reaches the vulnerable .NET code path. The malformed field forces the loop to iterate far more times than expected. Repeated requests amplify the effect, saturating worker threads and blocking legitimate traffic. Refer to the Microsoft CVE-2026-62901 Advisory for the specific components and inputs Microsoft identifies as affected.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no sanitized proof-of-concept has been released by Microsoft or third parties.

Detection Methods for CVE-2026-62901

Indicators of Compromise

Sustained CPU saturation in dotnet.exe or w3wp.exe worker processes without corresponding legitimate traffic volume.
Sharp increase in request latency or thread-pool exhaustion errors in ASP.NET Core logs.
Repeated inbound requests from a small set of source IPs targeting the same endpoint with oversized numeric or length fields.
Application restarts or health-check failures correlated with specific request patterns.

Detection Strategies

Monitor .NET runtime performance counters for abnormal loop-bound CPU consumption on request-handling threads.
Correlate HTTP request payload sizes and parameter values against baseline distributions to flag outliers.
Alert on repeated 5xx responses, request timeouts, or worker recycles that align with a common request signature.

Monitoring Recommendations

Enable structured logging on ASP.NET Core middleware to capture request parameters that reach the affected components.
Forward runtime metrics and application logs to a central analytics platform for cross-host correlation.
Configure alerting on threshold breaches for CPU, thread count, and request-duration percentiles per service.

How to Mitigate CVE-2026-62901

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-62901 Advisory as soon as it is available for your .NET version.
Inventory all hosts and containers running .NET runtimes and identify internet-exposed services first.
Rate-limit and size-limit inbound requests to .NET endpoints at the reverse proxy, load balancer, or WAF.

Patch Information

Microsoft has published guidance for CVE-2026-62901 through the Microsoft Security Response Center. Administrators should follow the update instructions in the Microsoft CVE-2026-62901 Advisory and install the corresponding .NET runtime or SDK update on all affected hosts. Rebuild and redeploy self-contained .NET applications to pull in the fixed runtime.

Workarounds

Enforce strict input validation on numeric fields, length parameters, and collection sizes before they reach application logic.
Configure request body size limits and timeouts in Kestrel or IIS to bound the resources any single request can consume.
Deploy WAF rules that reject requests with implausibly large numeric parameters targeting known endpoints.
Isolate critical .NET workloads behind circuit breakers so a single overloaded instance does not cascade to dependent services.

bash

# Configuration example: enforce Kestrel request limits in ASP.NET Core
# Program.cs
builder.WebHost.ConfigureKestrel(options =>
{
    options.Limits.MaxRequestBodySize = 1_048_576;      // 1 MB
    options.Limits.KeepAliveTimeout = TimeSpan.FromSeconds(30);
    options.Limits.RequestHeadersTimeout = TimeSpan.FromSeconds(10);
    options.Limits.MaxConcurrentConnections = 1000;
});