CVE-2026-96959

A flaw was found in .NET. An unauthenticated remote attacker can exploit improper resource allocation and a lack of rate limiting over the network to exhaust system resources. This flaw leads to a Denial of Service (DoS), causing the affected application or service to become unavailable to legitimate users.

A resource management flaw was found in .NET. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted network requests to an application running on an affected .NET runtime. Because the application allocates resources without limits or throttling, processing these requests leads to severe memory or connection exhaustion, resulting in a denial of service for legitimate users without compromising data integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Deploy reverse-proxy rate limiting, connection thresholds, and strict request timeouts to drop abusive network requests before they reach the backend .NET service. Enforce CPU and memory cgroup limits on application containers to isolate resource exhaustion.