DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-62901: CVE-2026-62901: Remote Denial of Service via Infinite Loop in .NET WebSockets Engine

#security #cve #cybersecurity

CVE-2026-62901: Remote Denial of Service via Infinite Loop in .NET WebSockets Engine

Vulnerability ID: CVE-2026-62901
CVSS Score: 7.5
Published: 2026-08-11

CVE-2026-62901 is a high-severity Denial of Service (DoS) vulnerability in the Microsoft .NET ecosystem, specifically affecting the System.Net.WebSockets frame-processing engine and associated network transports. Under certain circumstances, a remote, unauthenticated attacker can exploit this vulnerability by sending malformed or specifically crafted WebSocket packets over the network, causing a targeted .NET application server to enter a tight infinite loop. This behavior results in 100% CPU utilization on the executing thread, starving application resources and leading to a complete Denial of Service.

TL;DR

A remote, unauthenticated attacker can trigger an infinite loop and 100% CPU exhaustion in .NET servers by sending a malformed WebSocket frame header followed by an immediate connection termination.

Technical Details

  • CWE ID: CWE-606: Unchecked Input for Loop Condition
  • Attack Vector: Network
  • CVSS v3.1: 7.5 (High)
  • Impact: Denial of Service (DoS) via 100% CPU Exhaustion
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • .NET 10.0 runtime
  • .NET 9.0 runtime
  • .NET 8.0 runtime
  • Visual Studio 2022
  • Visual Studio 2026
  • .NET 10.0: >= 10.0.0, < 10.0.11 (Fixed in: 10.0.11)
  • .NET 9.0: >= 9.0.0, < 9.0.19 (Fixed in: 9.0.19)
  • .NET 8.0: >= 8.0.0, < 8.0.30 (Fixed in: 8.0.30)
  • Visual Studio 2022: >= 17.14.0, < 17.14.38 (Fixed in: 17.14.38)
  • Visual Studio 2026: >= 18.0, < 18.8.3 (Fixed in: 18.8.3)

Code Analysis

Commit: 18c8837

Fix infinite loop in WebSocket parsing when stream returns EOF prematurely

Commit: 6d9e1b3

Update MicrosoftNativeQuicMsQuicSchannelVersion to 2.5.9 in eng/Versions.props

Mitigation Strategies

  • Upgrade .NET Runtime and SDK to patched versions
  • Configure reverse proxy rate limits for WebSocket connections
  • Implement aggressive connection timeouts on proxy/WAF layers

Remediation Steps:

  1. Identify all hosts running .NET 8.0, 9.0, or 10.0 runtime environments.
  2. Apply the latest servicing updates: 8.0.30, 9.0.19, or 10.0.11.
  3. Update Visual Studio installations to 17.14.38 (VS 2022) or 18.8.3 (VS 2026).
  4. Recompile self-contained deployments with the updated SDK to bundle the secure native MsQuic library (2.5.9).
  5. Deploy monitoring rules to observe thread pool starvation and abnormal CPU usage on .NET web servers.

References

Read the full report for CVE-2026-62901 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)