{"id":"CVE-2026-96959","sourceIdentifier":"secure@microsoft.com","published":"2026-10-13T19:22:08.527","lastModified":"2026-10-22T22:20:09.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5","platforms":["Windows 11 version 26H1","Windows Server 2012","Windows Server 2012 R2"],"versions":[{"version":"3.5.0","lessThan":"2.0.50727.9188 AND 3.0.30729.9171","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2","platforms":["Windows 10 version 1607","Windows Server 2016","Windows Server 2019"],"versions":[{"version":"3.0.0.0","lessThan":"2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.7.2","platforms":["Windows 10 version 1809"],"versions":[{"version":"4.7.0","lessThan":"2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.8","platforms":["Windows 10 version 1809","Windows 10 version 21H2","Windows 10 version 22H2","Windows Server 2019","Windows Server 2022"],"versions":[{"version":"4.8.0","lessThan":"2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.8.1","platforms":["Windows 10 version 21H2","Windows 10 version 22H2","Windows 11 version 23H2","Windows 11 version 24H2","Windows 11 version 25H2","Windows 11 version 26H2","Windows Server 2022","Windows Server 2025"],"versions":[{"version":"4.8.1","lessThan":"2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2","platforms":["Windows Server 2012","Windows Server 2012 R2"],"versions":[{"version":"4.7.0","lessThan":"4.7.4150.0","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 4.8","platforms":["Windows 10 version 1607","Windows Server 2012","Windows Server 2012 R2","Windows Server 2016"],"versions":[{"version":"4.8.0","lessThan":"4.8.4811.0","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 4.8.1","platforms":["Windows 11 version 26H1"],"versions":[{"version":"4.8.0.0","lessThan":"4.8.9363.0","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"System.Security.Cryptography.Xml","platforms":[".NET 10.0 runtime installed on Linux",".NET 10.0 runtime installed on Mac OS",".NET 10.0 runtime installed on Windows",".NET 11.0 runtime installed on Linux",".NET 11.0 runtime installed on Mac OS",".NET 11.0 runtime installed on Windows",".NET 8.0 runtime installed on Linux",".NET 8.0 runtime installed on Mac OS",".NET 8.0 runtime installed on Windows",".NET 9.0 runtime installed on Linux",".NET 9.0 runtime installed on Mac OS",".NET 9.0 runtime installed on Windows"],"versions":[{"version":"10.0.0","lessThan":"10.0.13","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-13T19:37:58.924694Z","id":"CVE-2026-96959","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.5","matchCriteriaId":"19A6ED34-B810-42BF-9256-8632F965EBED"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.21","matchCriteriaId":"FE03DAA3-668A-49A0-8545-D141D5B41F7C"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.13","matchCriteriaId":"C27EB901-DF95-4DC2-AF6A-A95FE10E9A4C"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*","matchCriteriaId":"5DACF2FE-CF61-43E4-8A3F-F7A358DE8A01"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*","matchCriteriaId":"280B2E64-3163-40AB-A048-14D58DEC42FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*","matchCriteriaId":"12357908-3294-46EF-85A0-DA3F86C97489"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*","matchCriteriaId":"849FC8F5-86CD-4B5D-ADFD-9CB16EA75D09"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*","matchCriteriaId":"C86E87E2-B236-4AC9-B6C3-64B9CDEC91EB"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*","matchCriteriaId":"9B14656E-2BB0-4B4B-B518-F3D5108253ED"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*","matchCriteriaId":"E09C9DB3-F42C-4442-9CF0-24A780D094C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"67035E86-61F5-421E-B243-EF64458AD8BA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"},{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*","matchCriteriaId":"934D4E46-12C1-41DC-A28C-A2C430E965E4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:*:*","matchCriteriaId":"7423CCF1-A5B7-4C74-868B-A8F7C2ED2271"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*","matchCriteriaId":"2D3F18AF-84ED-473B-A8DF-65EB23C475AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*","matchCriteriaId":"61019899-D7AF-46E4-A72C-D189180F66AB"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","matchCriteriaId":"A7DF96F8-BA6A-4780-9CA3-F719B3F81074"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","matchCriteriaId":"DB18C4CE-5917-401E-ACF7-2747084FD36E"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*","matchCriteriaId":"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*","matchCriteriaId":"A16AD2B0-2189-4E8E-B7FC-CE598CA1CB2D"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*","matchCriteriaId":"734112B3-1383-4BE3-8721-C0F84566B764"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*","matchCriteriaId":"36B0E40A-84EF-4099-A395-75D6B8CDA196"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*","matchCriteriaId":"3EF7A75E-EE27-4AA7-8D84-9D696728A4CE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","matchCriteriaId":"A7DF96F8-BA6A-4780-9CA3-F719B3F81074"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","matchCriteriaId":"DB18C4CE-5917-401E-ACF7-2747084FD36E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*","matchCriteriaId":"E039CE1F-B988-4741-AE2E-5B36E2AF9688"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*","matchCriteriaId":"934D4E46-12C1-41DC-A28C-A2C430E965E4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*","matchCriteriaId":"2F513002-D8C1-4D3A-9F79-4B52498F67E9"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8DC08D-A860-493A-8AA6-1AD4A0A511AD"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:*","matchCriteriaId":"42D329B2-432D-4029-87EB-4C3C5F55CD95"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:*:*","matchCriteriaId":"A529CED5-0DF0-4203-85C0-894CAF37E159"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:*:*","matchCriteriaId":"9CCAC090-0001-4ED9-897A-EB4500A39E7C"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_11_26h2:-:*:*:*:*:*:*:*","matchCriteriaId":"99532A23-C809-4BE1-BB05-44EDA733F1C2"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*","matchCriteriaId":"821614DD-37DD-44E2-A8A4-FE8D23A33C3C"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:*","matchCriteriaId":"C2145B2C-E779-4CB3-8D0E-0786DD5A7EE1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*","matchCriteriaId":"E039CE1F-B988-4741-AE2E-5B36E2AF9688"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*","matchCriteriaId":"2D3F18AF-84ED-473B-A8DF-65EB23C475AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*","matchCriteriaId":"2E332666-2E03-468E-BC30-299816D6E8ED"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*","matchCriteriaId":"2F513002-D8C1-4D3A-9F79-4B52498F67E9"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8DC08D-A860-493A-8AA6-1AD4A0A511AD"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*","matchCriteriaId":"DB79EE26-FC32-417D-A49C-A1A63165A968"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*","matchCriteriaId":"821614DD-37DD-44E2-A8A4-FE8D23A33C3C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*","matchCriteriaId":"E039CE1F-B988-4741-AE2E-5B36E2AF9688"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*","matchCriteriaId":"3EF7A75E-EE27-4AA7-8D84-9D696728A4CE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*","matchCriteriaId":"2E332666-2E03-468E-BC30-299816D6E8ED"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*","matchCriteriaId":"E039CE1F-B988-4741-AE2E-5B36E2AF9688"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*","matchCriteriaId":"A16AD2B0-2189-4E8E-B7FC-CE598CA1CB2D"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*","matchCriteriaId":"734112B3-1383-4BE3-8721-C0F84566B764"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*","matchCriteriaId":"36B0E40A-84EF-4099-A395-75D6B8CDA196"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*","matchCriteriaId":"3EF7A75E-EE27-4AA7-8D84-9D696728A4CE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*","matchCriteriaId":"61019899-D7AF-46E4-A72C-D189180F66AB"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*","matchCriteriaId":"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*","matchCriteriaId":"DB79EE26-FC32-417D-A49C-A1A63165A968"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*","matchCriteriaId":"E039CE1F-B988-4741-AE2E-5B36E2AF9688"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:*:*","matchCriteriaId":"7423CCF1-A5B7-4C74-868B-A8F7C2ED2271"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","matchCriteriaId":"A7DF96F8-BA6A-4780-9CA3-F719B3F81074"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","matchCriteriaId":"DB18C4CE-5917-401E-ACF7-2747084FD36E"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96959","source":"secure@microsoft.com","tags":["Vendor Advisory"]}]}