NetSight
IP …
high7.5

CVE-2026-42899

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Impact

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected packages

EcosystemPackageAffectedFixed in
nugetMicrosoft.AspNetCore.App.Runtime.win-arm>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.win-arm64>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.win-x64>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.win-x86>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.linux-arm>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.linux-arm64>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.linux-musl-x64>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.linux-x64>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.osx-arm64>= 8.0.0, <= 8.0.268.0.27
nugetMicrosoft.AspNetCore.App.Runtime.osx-x64>= 8.0.0, <= 8.0.268.0.27

Affected products

VendorProductAffected versions
Microsoft.Net
from 8.0.0 before 8.0.27
from 9.0.0 before 9.0.16
from 10.0.0 before 10.0.8

Weakness classification

CWE-835

References