cve 2026 35611

CVE-2026-35611 is a regular expression denial of service vulnerability in Addressable URI templates. Microsoft describes it as an availability attack risk that can cause total or partial loss of availability in impacted components. The vulnerability allows an attacker to trigger sustained resource exhaustion, making services slow, unresponsive, or completely unavailable. This ReDoS flaw is particularly concerning because it resides in a widely reused dependency, potentially affecting many applications. The tag covers discussions about the technical details, impact, and mitigation strategies for CVE-2026-35611, emphasizing the importance of addressing availability bugs that can be as disruptive as code-execution vulnerabilities.