CVE-2026-96960

A flaw was found in .NET. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted network requests that trigger asymmetric resource consumption, causing the system to expend disproportionate processing resources. Successful exploitation leads to a Denial of Service (DoS), rendering the affected application or service unavailable to legitimate users.

This vulnerability is rated as Important because remote, unauthenticated attackers can cause severe service disruption by exhausting system processing capacity without needing specialized privileges. In standard deployments, the flaw only impacts availability when services parse untrusted XML structures, without exposing confidential data or allowing arbitrary code execution. Red Hat builds of .NET are largely unaffected where the vulnerable code is absent, minimizing risk across supported platforms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.