CVE-2026-70162Medium· 5.9▾ SunlitA denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web applicati…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.8%
0.8% → 0.9%
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
System.Security.Cryptography.Pkcs >= 10.0.0, <= 10.0.12System.Security.Cryptography.Pkcs >= 11.0.0-preview.1, <= 11.0.0-rc.1System.Security.Cryptography.Pkcs >= 8.0.0, <= 8.0.1System.Security.Cryptography.Pkcs >= 9.0.0, <= 9.0.20Patched in:
System.Security.Cryptography.Pkcs 10.0.13System.Security.Cryptography.Pkcs 11.0.0-rc.2System.Security.Cryptography.Pkcs 8.0.2System.Security.Cryptography.Pkcs 9.0.21Source: https://github.com/advisories/GHSA-2fmv-rv2c-59x7
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-21986High· 7.5.NET Denial of Service Vulnerability
CVE-2026-109468High· 7.5ASP.NET Core Denial of Service Vulnerability
CVE-2026-109932Medium· 5.9undici is an HTTP client library for Node.js
CVE-2026-97031High· 7.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references
CVE-2026-78669High· 7.5A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
CVE-2026-78659High· 7.5When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler