.net vulnerabilities

5 known vulnerabilities in .net from Microsoft. 5 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio…

  CVE-2026-33116Apr 14, 2026MicrosoftEPSS 2.23%

  Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

• 7.5 High severity

  .net: Uncontrolled Resource Consumption

  CVE-2026-25667Mar 19, 2026MicrosoftEPSS 3.38%

  ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processin

• 8.0 High severity

  .NET 8.0: External Control of File Name or Path

  CVE-2025-26646May 13, 2025MicrosoftEPSS 1.29%

  External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

• 7.5 High severity

  HTTP/2 Rapid Reset Attack Exploited

  CVE-2023-44487Oct 10, 2023IETFEPSS 100%

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

• 7.5 High severity

  Microsoft .NET Core and Visual Studio Denial-of-Service Exploited

  CVE-2023-38180Aug 8, 2023MicrosoftEPSS 14.1%

  .NET and Visual Studio Denial of Service Vulnerability