CVE-2026-58280
dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 14, 2026
Updated · October 30, 2026
Description
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
Statement
This vulnerability is rated as having an Important impact because an unauthenticated remote attacker can trigger excessive resource consumption over the network, leading to service disruption without needing elevated privileges. In Red Hat environments, exposure is limited to .NET applications and services that ingest untrusted XML content and evaluate XML signatures or canonicalization transforms. Workloads that only process validated, trusted data or do not implement signed XML parsing remain unaffected.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')