CVE-2026-62901: 
C# vulnerability analysis and mitigation

CVE-2026-62901 is a Denial of Service vulnerability in Microsoft .NET caused by an unchecked input for loop condition in the System.Net.WebSockets component. Disclosed on August 11, 2026, as part of Microsoft's August 2026 Patch Tuesday, it affects .NET 8.0 (< 8.0.30), .NET 9.0 (< 9.0.19), .NET 10.0 (< 10.0.11), Visual Studio 2022 (17.14.0–17.14.37), and Visual Studio 2026 (18.8.0–18.8.2) across Windows, Linux, and macOS. It carries a CVSS v3.1 base score of 7.5 (High) (MSRC Advisory, GitHub Advisory).

The vulnerability is classified as CWE-606 (Unchecked Input for Loop Condition) and resides in the System.Net.WebSockets library within the .NET runtime. An unauthenticated remote attacker can send specially crafted network input that triggers an infinite or excessively long loop in the WebSocket processing code, exhausting CPU or other resources. No authentication, user interaction, or elevated privileges are required, making the attack fully automatable over the network (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes the affected .NET application to become unresponsive or crash, resulting in a complete loss of availability for the targeted service. There is no impact on confidentiality or data integrity. Applications using System.Net.WebSockets that are network-accessible — including web APIs, real-time communication services, and any self-contained deployments built on affected .NET runtime versions — are at risk (GitHub Advisory, MSRC Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is rated automatable by NVD SSVC analysis, meaning it can be exploited at scale without manual interaction. The EPSS score is approximately 1.06% (62nd percentile), indicating a moderate near-term exploitation probability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, MSRC Advisory).

Microsoft has released patched versions addressing this vulnerability: .NET 8.0 → update to 8.0.30 or later; .NET 9.0 → update to 9.0.19 or later; .NET 10.0 → update to 10.0.11 or later; Visual Studio 2022 → update to 17.14.38 or later; Visual Studio 2026 → update to 18.8.3 or later. Developers with self-contained applications targeting affected runtime versions must recompile and redeploy after updating. Visual Studio users will be prompted to update automatically, which also updates bundled .NET SDKs. Red Hat Enterprise Linux users should apply the relevant RHSA errata (RHSA-2026:54538 through RHSA-2026:55858) (GitHub Advisory, Red Hat Bugzilla, MSRC Advisory).

The vulnerability was covered as part of broader August 2026 Patch Tuesday reporting, with security outlets such as BleepingComputer and CyberSecurityNews noting it among approximately 400 fixes released that month. The .NET team published a dedicated servicing update blog post and a GitHub announcement (dotnet/announcements#428) detailing the fix. Researchers Kevin Gosse and hamayanhamayan were acknowledged by Microsoft for reporting the issue (GitHub Advisory, .NET Blog).