CVE-2026-42899

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
Microsoft.NET 10.0>= 10.0.0, < 10.0.8
Microsoft.NET 8.0>= 8.0.0, < 8.0.27
Microsoft.NET 9.0>= 9.0.0, < 9.0.16
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—

References

Timeline

Published
May 12, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-42909.1The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST APCVE-2026-429008.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attaCVE-2026-4290110.0Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.CVE-2026-429027.8Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.CVE-2026-429036.5Null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network.CVE-2026-429049.6Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.CVE-2026-429057.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-429065.5Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.CVE-2026-429076.5Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a netCVE-2026-429087.5Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-429097.5Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized CVE-2026-429107.8Out-of-bounds write in Windows Hotpatch Monitoring Service allows an authorized attacker to elevate privileges locally.
CVE-2026-42899: High severity, CVSS 7.5 | Vulnix