{"uuid": "bc6664b7-a5da-43d4-abc5-3c9c5fb0feef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62901", "type": "seen", "source": "https://gist.github.com/alon710/ab5adbb774ee3c6232d5f9c5daa911a0", "content": "# CVE-2026-62901: CVE-2026-62901: Remote Denial of Service via Infinite Loop in .NET WebSockets Engine\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62901\n\n## Summary\nCVE-2026-62901 is a high-severity Denial of Service (DoS) vulnerability in the Microsoft .NET ecosystem, specifically affecting the System.Net.WebSockets frame-processing engine and associated network transports. Under certain circumstances, a remote, unauthenticated attacker can exploit this vulnerability by sending malformed or specifically crafted WebSocket packets over the network, causing a targeted .NET application server to enter a tight infinite loop. This behavior results in 100% CPU utilization on the executing thread, starving application resources and leading to a complete Denial of Service.\n\n## TL;DR\nA remote, unauthenticated attacker can trigger an infinite loop and 100% CPU exhaustion in .NET servers by sending a malformed WebSocket frame header followed by an immediate connection termination.\n\n## Technical Details\n\n- **CWE ID**: CWE-606: Unchecked Input for Loop Condition\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **Impact**: Denial of Service (DoS) via 100% CPU Exhaustion\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- .NET 10.0 runtime\n- .NET 9.0 runtime\n- .NET 8.0 runtime\n- Visual Studio 2022\n- Visual Studio 2026\n- **.NET 10.0**: >= 10.0.0, < 10.0.11 (Fixed in: `10.0.11`)\n- **.NET 9.0**: >= 9.0.0, < 9.0.19 (Fixed in: `9.0.19`)\n- **.NET 8.0**: >= 8.0.0, < 8.0.30 (Fixed in: `8.0.30`)\n- **Visual Studio 2022**: >= 17.14.0, < 17.14.38 (Fixed in: `17.14.38`)\n- **Visual Studio 2026**: >= 18.0, < 18.8.3 (Fixed in: `18.8.3`)\n\n## Mitigation\n\n- Upgrade .NET Runtime and SDK to patched versions\n- Configure reverse proxy rate limits for WebSocket connections\n- Implement aggressive connection timeouts on proxy/WAF layers\n\n**Remediation Steps:**\n1. Identify all hosts running .NET 8.0, 9.0, or 10.0 runtime environments.\n2. Apply the latest servicing updates: 8.0.30, 9.0.19, or 10.0.11.\n3. Update Visual Studio installations to 17.14.38 (VS 2022) or 18.8.3 (VS 2026).\n4. Recompile self-contained deployments with the updated SDK to bundle the secure native MsQuic library (2.5.9).\n5. Deploy monitoring rules to observe thread pool starvation and abnormal CPU usage on .NET web servers.\n\n## References\n\n- [Microsoft Security Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62901)\n- [CVE-2026-62901 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-62901)\n- [Dotnet Runtime Fix Commit 1](https://github.com/dotnet/runtime/commit/18c88378c1c70a0b3a2c69d783f89b8a8ea0143e)\n- [Dotnet Runtime Fix Commit 2](https://github.com/dotnet/runtime/commit/6d9e1b3058c87cb4ba51e2b5f160e098819a5ad2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62901) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T01:31:15.352140Z"}