CVE-2026-70162 · GHSA-2fmv-rv2c-59x7
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
- Risk score
- 56/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing …
- Affected
- System.Security.Cryptography.Pkcs (nuget) >= 10.0.0, <= 10.0.12; System.Security.Cryptography.Pkcs (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; System.Security.Cryptography.Pkcs (nuget) >= 8.0.0, <= 8.0.1; System.Security.Cryptography.Pkcs (nuget) >= 9.0.0, <= 9.0.20
- Fix
- Upgrade System.Security.Cryptography.Pkcs to 10.0.13 or 11.0.0-rc.2 or 8.0.2 or 9.0.21 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
System.Security.Cryptography.Pkcs: Amber, patch this week. Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
The flaws
- CVE-2026-70162: Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability (CVSS 5.9 · EPSS 1%)
- CVE-2026-84008: Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
The fix
Fix: Upgrade System.Security.Cryptography.Pkcs to 10.0.13 or 11.0.0-rc.2 or 8.0.2 or 9.0.21 (whichever matches your release line) or later.
Who is exposed: System.Security.Cryptography.Pkcs (nuget) >= 10.0.0, <= 10.0.12; System.Security.Cryptography.Pkcs (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; System.Security.Cryptography.Pkcs (nuget) >= 8.0.0, <= 8.0.1; System.Security.Cryptography.Pkcs (nuget) >= 9.0.0, <= 9.0.20
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-405 (CWE-405). 12 other warnings in 30 days
Why it is Yellow
- CVSS 5.9 medium
- On your watchlist: .net, NuGet
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| System.Security.Cryptography.Pkcs | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| System.Security.Cryptography.Pkcs | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| System.Security.Cryptography.Pkcs | nuget | >= 8.0.0, <= 8.0.1 | 8.0.2 |
| System.Security.Cryptography.Pkcs | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
References
- https://github.com/advisories/GHSA-2fmv-rv2c-59x7
- https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7
- https://github.com/dotnet/announcements/issues/454
- https://github.com/dotnet/runtime/issues/135699
- https://nvd.nist.gov/vuln/detail/CVE-2026-70162
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162
- https://github.com/advisories/GHSA-2fmv-rv2c-59x7
Original description
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.
Last activity 13 Oct 2026. Patch Forecast updates every hour.