DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-50651: CVE-2026-50651: Denial of Service via Uncontrolled Resource Allocation in .NET System.Net.Http

#security #cve #cybersecurity

CVE-2026-50651: Denial of Service via Uncontrolled Resource Allocation in .NET System.Net.Http

Vulnerability ID: CVE-2026-50651
CVSS Score: 7.5
Published: 2026-07-20

CVE-2026-50651 is a high-severity Denial of Service vulnerability in Microsoft .NET runtimes, SDKs, and Visual Studio installations. It stems from a weakness in System.Net.Http (CWE-770), where the HTTP/2 connection handling state machine fails to throttle server-initiated protocol streams and control frames. An attacker-controlled server can exploit this by returning highly fragmented or infinite control and continuation frame sequences. This forces the client to allocate memory indefinitely on the managed heap, eventually provoking an unhandled Out-of-Memory (OOM) exception and application crash.

TL;DR

Uncontrolled resource allocation in .NET's HTTP/2 implementation (System.Net.Http) allows a malicious server to exhaust client heap memory and trigger an Out-of-Memory (OOM) application crash via infinite or highly fragmented protocol frames.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network (AV:N)
  • CVSS Score: 7.5 (High)
  • EPSS Score: 0.00617 (Percentile: 45.65%)
  • Impact: Endpoint Denial of Service (System Resource Exhaustion)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not Listed

Affected Systems

  • .NET 10.0 (versions < 10.0.6)
  • .NET 9.0 (versions < 9.0.18)
  • .NET 8.0 (versions < 8.0.29)
  • Microsoft Visual Studio 2022 (version 17.12 < 17.12.22)
  • Microsoft Visual Studio 2022 (version 17.14 < 17.14.36)
  • Microsoft Visual Studio 2026 (version 18.7 < 18.7.4)
  • .NET 10.0: < 10.0.6 (Fixed in: 10.0.6)
  • .NET 9.0: < 9.0.18 (Fixed in: 9.0.18)
  • .NET 8.0: < 8.0.29 (Fixed in: 8.0.29)

Mitigation Strategies

  • Upgrade the .NET runtime to version 10.0.6, 9.0.18, 8.0.29, or higher.
  • Enforce HTTP/1.1-only fallback on HttpClient instances when querying third-party or untrusted endpoints.
  • Deploy network IPS/WAF solutions capable of detecting abnormal HTTP/2 frame patterns such as continuous CONTINUATION sequences or rapid PING bursts.

Remediation Steps:

  1. Identify all production servers and containerized hosts utilizing vulnerable .NET versions (8.0, 9.0, or 10.0).
  2. Apply the latest July 2026 cumulative security updates via package managers or manual runtime installation.
  3. Re-configure critical outbound HttpClient requests to limit version negotiation where patching is delayed.
  4. Verify system stability and monitor heap memory utilization under test HTTP/2 connections.

References

Read the full report for CVE-2026-50651 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)