CVE-2026-96959: .NET Resource Allocation DOS Vulnerability

CVE-2026-96959 Overview

CVE-2026-96959 is a denial-of-service vulnerability in Microsoft .NET caused by allocation of resources without limits or throttling [CWE-770]. An unauthenticated remote attacker can exhaust server resources over the network, rendering affected .NET services unavailable to legitimate users. The weakness requires no privileges and no user interaction, and it targets the availability of the host process without affecting confidentiality or integrity.

Critical Impact
Unauthenticated network attackers can force resource exhaustion in .NET workloads, producing sustained denial of service against web applications, APIs, and background services that rely on the affected runtime components.

Affected Products

Microsoft .NET (specific versions enumerated in the Microsoft Security Update Guide)
Applications and services built on the affected .NET runtime
ASP.NET workloads hosted on vulnerable .NET versions

Discovery Timeline

2026-10-13 - CVE-2026-96959 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-96959

Vulnerability Analysis

The flaw is classified under [CWE-770]: Allocation of Resources Without Limits or Throttling. Affected .NET components accept network input and allocate memory, threads, or other resources without enforcing an upper bound. An attacker who repeatedly submits crafted requests can drive the process into resource exhaustion, causing it to stop responding or crash.

Because the attack is executed over the network with low complexity and no authentication, exposure is broad for any .NET service reachable from untrusted networks. The impact is limited to availability; data confidentiality and integrity remain intact. Microsoft documents the specific affected builds and fixed versions in the Microsoft CVE-2026-96959 Update Guide.

Root Cause

The root cause is missing throttling or quota enforcement in a .NET code path that processes network-supplied data. The runtime allocates resources proportional to attacker-controlled input without validating cumulative consumption against system limits. Repeated or amplified requests therefore scale resource usage beyond safe thresholds.

Attack Vector

Exploitation occurs over the network. An attacker sends crafted traffic to a listening .NET service and triggers unbounded allocation. No credentials, prior access, or user interaction are required. Services exposed to the internet or shared network segments carry the highest risk.

No verified exploit code is publicly available at the time of writing. Technical details on the specific trigger are described in the vendor advisory linked above.

Detection Methods for CVE-2026-96959

Indicators of Compromise

Sudden, sustained growth in memory, thread count, or handle usage of dotnet.exe, w3wp.exe, or custom .NET host processes
Repeated requests from a small set of source addresses immediately preceding process degradation or crash
Application pool recycles, out-of-memory exceptions, or unresponsive HTTP endpoints logged in Windows Event Log or ASP.NET telemetry

Detection Strategies

Baseline normal CPU, memory, and request-rate profiles for each .NET service, then alert on deviations consistent with resource exhaustion
Inspect reverse proxy and WAF logs for high-volume or oversized requests targeting .NET endpoints
Correlate process crashes with inbound network bursts using EDR and SIEM telemetry

Monitoring Recommendations

Enable detailed performance counters for .NET runtime memory, GC, and thread pool metrics
Forward IIS, Kestrel, and application logs to a centralized analytics platform for anomaly detection
Monitor network edge devices for traffic patterns indicative of application-layer DoS against .NET workloads

How to Mitigate CVE-2026-96959

Immediate Actions Required

Inventory all .NET runtime versions in use across servers, containers, and developer workstations
Apply the Microsoft security update referenced in the Microsoft CVE-2026-96959 Update Guide as soon as change windows allow
Restrict exposure of non-essential .NET services from untrusted networks pending patch deployment

Patch Information

Microsoft has published fixed builds and remediation guidance in the Microsoft Security Response Center update guide. Administrators should install the vendor-provided updates for each affected .NET runtime and redistributable package, then restart dependent services to load the patched assemblies.

Workarounds

Place a reverse proxy, WAF, or API gateway in front of .NET services and enforce request-rate limits, connection quotas, and maximum payload sizes
Configure IIS application pool recycling, request limits, and maxConcurrentRequestsPerCPU to cap resource consumption per worker
Apply network segmentation and ACLs to restrict reachability of .NET services to known clients until patches are deployed

bash

# Configuration example: enforce request limits on IIS to reduce DoS exposure
appcmd set config /section:requestFiltering /requestLimits.maxAllowedContentLength:1048576
appcmd set config /section:webLimits /maxConnections:1000
appcmd set apppool "DefaultAppPool" /processModel.idleTimeout:00:05:00