cve-2026-42899

CVE-2026-42899 is an Important-rated denial-of-service vulnerability in ASP.NET Core, caused by an infinite-loop condition. It affects supported .NET 8.0, .NET 9.0, and .NET 10.0 installations on Windows, Linux, and macOS. The flaw is remote and unauthenticated, allowing an attacker to trigger a DoS without data theft or privilege escalation. Microsoft released a fix on May 12, 2026. Administrators running web workloads should assess the urgency of patching, as the vulnerability impacts a core platform component. This tag covers discussions about the vulnerability details, affected versions, and mitigation strategies for .NET and ASP.NET Core deployments.