CVE-2026-42899 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2026-42899

CVE-2026-42899

Published:May 12, 2026

Updated:May 18, 2026

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected Packages

Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.win-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.osx-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.win-x86 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.osx-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.win-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.osx-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.win-arm (NUGET):

Affected version(s) >=8.0.0-preview.1.23112.2 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.win-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.win-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.linux-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.linux-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.osx-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.win-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.osx-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.win-x86 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.linux-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.linux-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.8

Fix Suggestion:

Update to version 10.0.8

Microsoft.AspNetCore.App.Runtime.linux-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.win-x86 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.win-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Microsoft.AspNetCore.App.Runtime.osx-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.27

Fix Suggestion:

Update to version 8.0.27

Microsoft.AspNetCore.App.Runtime.linux-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.16

Fix Suggestion:

Update to version 9.0.16

Related Resources (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899

Do you need more information?

CVSS v4

Base Score:

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

NONE

Vulnerable System Integrity

NONE

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Exploit Maturity

UNPROVEN

Weakness Type (CWE)

Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-835

EPSS

Base Score:

0.04