Product:
ASP.NET Core
Summary
Loop with unreachable exit condition in ASP.NET Core allows an unauthorized attacker to deny service over a network. This vulnerability can lead to significant service disruption, impacting availability. Attackers can exploit this flaw without needing any privileges or user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-42899 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests to the ASP.NET Core application, causing it to enter an infinite loop. This results in the application becoming unresponsive, effectively denying service to legitimate users. The low complexity of the attack means that it can be executed easily over the network without requiring advanced skills.
Affected Products
- ASP.NET Core: A framework for building web applications and services.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, implementing rate limiting and monitoring network traffic can help detect and prevent potential denial of service attacks.