CVE-2026-33116

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33116", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-03-17T20:15:23.721Z", "datePublished": "2026-04-14T16:57:47.626Z", "dateUpdated": "2026-10-15T15:52:59.382Z"}, "containers": {"cna": {"title": ".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability", "datePublic": "2026-04-14T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0", "versionEndExcluding": "8.0.26"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.26"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.15"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.0", "versionEndExcluding": "4.8.4801.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.0", "versionEndExcluding": "2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.0", "versionEndExcluding": "2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.0", "versionEndExcluding": "4.8.4801.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.1", "versionEndExcluding": "2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5.0", "versionEndExcluding": "2.0.50727.8982 & 3.0.30729.8976"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0", "versions": [{"version": "10.0.0", "lessThan": "10.0.6", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"version": "8.0", "lessThan": "8.0.26", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"version": "8.0.0", "lessThan": "8.0.26", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0", "versions": [{"version": "9.0.0", "lessThan": "9.0.15", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5", "platforms": ["Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "versions": [{"version": "3.5.0", "lessThan": "2.0.50727.8982 & 3.0.30729.8976", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.7.2", "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows 10 Version 1809 for x64-based Systems"], "versions": [{"version": "4.7.0", "lessThan": "2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8", "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)"], "versions": [{"version": "4.8.0", "lessThan": "2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8.1", "platforms": ["Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 11 Version 22H2 for ARM64-based Systems", "Windows 11 Version 22H2 for x64-based Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems", "Windows 11 Version 26H1 for ARM64-based Systems", "Windows 11 version 26H1 for x64-based Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows Server 2022, 23H2 Edition (Server Core installation)", "Windows Server 2025", "Windows Server 2025 (Server Core installation)"], "versions": [{"version": "4.8.1", "lessThan": "2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "platforms": ["Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "versions": [{"version": "4.7.0", "lessThan": "4.8.4801.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.8", "platforms": ["Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "versions": [{"version": "4.8.0", "lessThan": "4.8.4801.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "lang": "en-US", "type": "CWE", "cweId": "CWE-835"}, {"description": "CWE-400: Uncontrolled Resource Consumption", "lang": "en-US", "type": "CWE", "cweId": "CWE-400"}, {"description": "CWE-20: Improper Input Validation", "lang": "en-US", "type": "CWE", "cweId": "CWE-20"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-10-15T15:52:59.382Z"}, "references": [{"name": ".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T19:48:26.946135Z", "id": "CVE-2026-33116", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T19:48:35.606Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "dotnet10.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:10.0.106-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "dotnet10.0", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:10.0.106-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "dotnet10.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:10.0.106-1.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el9_4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "dotnet10-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "10.0.106-1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "dotnet8-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8.0.126-1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "dotnet9-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9.0.116-1.hum1", "versionType": "rpm"}]}], "datePublic": "2026-04-14T18:38:58.320Z", "descriptions": [{"lang": "en", "value": "A flaw was found in .NET. A remote attacker could exploit this vulnerability by crafting a malicious XML document that triggers an infinite recursion within the XmlDecryptionTransform component. This could lead to a Denial of Service (DoS), making the affected system unresponsive."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-776", "description": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-33116"}, {"name": "RHBZ#2457741", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457741"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33116.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:13281"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:13280"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8467"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8470"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8472"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8473"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8468"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8475"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:13693"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:13283"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:13282"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8471"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8469"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8474"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:9077"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:9080"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:9205"}], "solutions": [{"lang": "en", "value": "RHSA-2026:13281: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:13280: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:8467: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:8470: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:8472: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:8473: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"}, {"lang": "en", "value": "RHSA-2026:8468: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"}, {"lang": "en", "value": "RHSA-2026:8475: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"}, {"lang": "en", "value": "RHSA-2026:13693: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:13283: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:13282: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:8471: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:8469: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:8474: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:9077: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:9080: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:9205: Red Hat Hardened Images"}], "timeline": [{"lang": "en", "time": "2026-04-13T05:12:13.834Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-14T18:38:58.320Z", "value": "Made public."}], "title": "dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:07:17.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:10.0.106-1.el10_1", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet10.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:8.0.126-1.el10_1", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet8.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:9.0.116-1.el10_1", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet9.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:9.0.116-1.el10_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet9.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:8.0.126-1.el10_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet8.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:8.0.126-1.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet8.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:10.0.106-1.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet10.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:9.0.116-1.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet9.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:8.0.126-1.el9_7", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet8.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:10.0.106-1.el9_7", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet10.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:9.0.116-1.el9_7", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet9.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:8.0.126-1.el9_4", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet8.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:9.0.116-1.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet9.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:8.0.126-1.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet8.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "10.0.106-1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet10-0-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "8.0.126-1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet8-0-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "9.0.116-1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "dotnet9-0-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-13T05:12:13.834Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-14T18:38:58.320Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:13281: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:13280: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:8467: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:8470: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:8472: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:8473: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"}, {"lang": "en", "value": "RHSA-2026:8468: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"}, {"lang": "en", "value": "RHSA-2026:8475: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"}, {"lang": "en", "value": "RHSA-2026:13693: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:13283: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:13282: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:8471: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:8469: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:8474: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:9077: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:9080: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:9205: Red Hat Hardened Images"}], "x_adpType": "supplier", "datePublic": "2026-04-14T18:38:58.320Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-33116", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457741", "name": "RHBZ#2457741", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33116.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13281", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13280", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8467", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8470", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8472", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8473", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8468", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8475", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13693", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13283", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13282", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8471", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8469", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:8474", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:9077", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:9080", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:9205", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in .NET. A remote attacker could exploit this vulnerability by crafting a malicious XML document that triggers an infinite recursion within the XmlDecryptionTransform component. This could lead to a Denial of Service (DoS), making the affected system unresponsive."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-776", "description": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:07:17.575Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33116", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T19:48:26.946135Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T19:48:32.945Z"}}], "cna": {"title": ".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.6", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"status": "affected", "version": "8.0", "lessThan": "8.0.26", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.26", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 9.0", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.15", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5", "versions": [{"status": "affected", "version": "3.5.0", "lessThan": "2.0.50727.8982 & 3.0.30729.8976", "versionType": "custom"}], "platforms": ["Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.7.2", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0", "versionType": "custom"}], "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows 10 Version 1809 for x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8", "versions": [{"status": "affected", "version": "4.8.0", "lessThan": "2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0", "versionType": "custom"}], "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8.1", "versions": [{"status": "affected", "version": "4.8.1", "lessThan": "2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0", "versionType": "custom"}], "platforms": ["Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 11 Version 22H2 for ARM64-based Systems", "Windows 11 Version 22H2 for x64-based Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems", "Windows 11 Version 26H1 for ARM64-based Systems", "Windows 11 version 26H1 for x64-based Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows Server 2022, 23H2 Edition (Server Core installation)", "Windows Server 2025", "Windows Server 2025 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "versions": [{"status": "affected", "version": "4.7.0", "lessThan": "4.8.4801.0", "versionType": "custom"}], "platforms": ["Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.8", "versions": [{"status": "affected", "version": "4.8.0", "lessThan": "4.8.4801.0", "versionType": "custom"}], "platforms": ["Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"]}], "datePublic": "2026-04-14T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116", "name": ".NET, .NET Framework, and Visual Studio Denial of Service Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}, {"lang": "en-US", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}, {"lang": "en-US", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.6", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.26", "versionStartIncluding": "8.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.26", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.15", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.8.4801.0", "versionStartIncluding": "4.8.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0", "versionStartIncluding": "4.8.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0", "versionStartIncluding": "4.7.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.8.4801.0", "versionStartIncluding": "4.7.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0", "versionStartIncluding": "4.8.1"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.50727.8982 & 3.0.30729.8976", "versionStartIncluding": "3.5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-10-15T15:52:59.382Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33116", "state": "PUBLISHED", "dateUpdated": "2026-10-15T15:52:59.382Z", "dateReserved": "2026-03-17T20:15:23.721Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-04-14T16:57:47.626Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": ".NET 10.0", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.6", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 8.0", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.26", "status": "affected", "version": "8.0", "versionType": "custom"}]}, {"product": ".NET 8.0", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.26", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}, {"product": ".NET 9.0", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.15", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}, {"platforms": ["Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "product": "Microsoft .NET Framework 3.5", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.8982 & 3.0.30729.8976", "status": "affected", "version": "3.5.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows 10 Version 1809 for x64-based Systems"], "product": "Microsoft .NET Framework 3.5 AND 4.7.2", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0", "status": "affected", "version": "4.7.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)"], "product": "Microsoft .NET Framework 3.5 AND 4.8", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0", "status": "affected", "version": "4.8.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 11 Version 22H2 for ARM64-based Systems", "Windows 11 Version 22H2 for x64-based Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems", "Windows 11 Version 26H1 for ARM64-based Systems", "Windows 11 Version 26H1 for x64-based Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows Server 2022, 23H2 Edition (Server Core installation)", "Windows Server 2025", "Windows Server 2025 (Server Core installation)"], "product": "Microsoft .NET Framework 3.5 AND 4.8.1", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0", "status": "affected", "version": "4.8.1", "versionType": "custom"}]}, {"platforms": ["Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "vendor": "Microsoft", "versions": [{"lessThan": "4.8.4801.0", "status": "affected", "version": "4.7.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "product": "Microsoft .NET Framework 4.8", "vendor": "Microsoft", "versions": [{"lessThan": "4.8.4801.0", "status": "affected", "version": "4.8.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "dotnet10.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:10.0.106-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "dotnet10.0", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:10.0.106-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "dotnet10.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:10.0.106-1.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el9_4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "dotnet9.0", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:9.0.116-1.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "dotnet8.0", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.126-1.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "dotnet10-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "10.0.106-1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "dotnet8-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8.0.126-1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "dotnet9-0-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9.0.116-1.hum1", "versionType": "rpm"}]}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD89D801-933E-4D78-9187-D2CA94370FA0", "versionEndExcluding": "10.0.6", "versionStartIncluding": "10.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB15ABFB-047C-4B69-BD19-68D3EFEDCB78", "versionEndExcluding": "8.0.26", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB2D66A6-4F92-4AB0-A8F0-FCE4EC0BED1A", "versionEndExcluding": "9.0.15", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*", "matchCriteriaId": "23317443-1968-4791-9F20-AD3B308A83D1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*", "matchCriteriaId": "23317443-1968-4791-9F20-AD3B308A83D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "3EF7A75E-EE27-4AA7-8D84-9D696728A4CE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "73D24713-D897-408D-893B-77A61982597D", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*", "matchCriteriaId": "306B7CE6-8239-4AED-9ED4-4C9F5B349F58", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*", "matchCriteriaId": "345FCD64-D37B-425B-B64C-8B1640B7E850", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "A16AD2B0-2189-4E8E-B7FC-CE598CA1CB2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*", "matchCriteriaId": "734112B3-1383-4BE3-8721-C0F84566B764", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "36B0E40A-84EF-4099-A395-75D6B8CDA196", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "3EF7A75E-EE27-4AA7-8D84-9D696728A4CE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*", "matchCriteriaId": "23317443-1968-4791-9F20-AD3B308A83D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*", "matchCriteriaId": "2D3F18AF-84ED-473B-A8DF-65EB23C475AF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "73D24713-D897-408D-893B-77A61982597D", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*", "matchCriteriaId": "306B7CE6-8239-4AED-9ED4-4C9F5B349F58", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*", "matchCriteriaId": "345FCD64-D37B-425B-B64C-8B1640B7E850", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "8FC46499-DB6E-48BF-9334-85EE27AFE7AF", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "83A79DD6-E74E-419F-93F1-323B68502633", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*", "matchCriteriaId": "61959ACC-B608-4556-92AF-4D94B338907A", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "A9D54EE6-30AF-411C-A285-A4DCB6C6EC06", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "C230D3BF-7FCE-405C-B62E-B9190C995C3C", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*", "matchCriteriaId": "1FD62DCB-66D1-4CEA-828E-0BD302AC63CA", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*", "matchCriteriaId": "23317443-1968-4791-9F20-AD3B308A83D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "934D4E46-12C1-41DC-A28C-A2C430E965E4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "8FC46499-DB6E-48BF-9334-85EE27AFE7AF", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "83A79DD6-E74E-419F-93F1-323B68502633", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*", "matchCriteriaId": "61959ACC-B608-4556-92AF-4D94B338907A", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "A9D54EE6-30AF-411C-A285-A4DCB6C6EC06", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "C230D3BF-7FCE-405C-B62E-B9190C995C3C", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*", "matchCriteriaId": "1FD62DCB-66D1-4CEA-828E-0BD302AC63CA", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "B2D24C54-F04F-4717-B614-FE67B3ED9DC0", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "D5EC3F68-8F41-4F6B-B2E5-920322A4A321", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "B0301BA0-81DB-4FC1-9BC3-EB48A56BC608", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "8E3C1327-F331-4448-A253-00EAC7428317", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "08EE1F3A-A8DE-4867-BB5B-8A8ED867F3CA", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "B1670829-6A8C-4688-B7A5-3DFB878A4861", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "024EE6EC-6D62-4EAC-B1EF-A5E4EAD439A1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "25D142AB-B61D-43F3-B7E6-DB9140EFEF75", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:*", "matchCriteriaId": "CBFE0371-0C4D-406A-9EC7-456104271C3E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:*", "matchCriteriaId": "F2B83840-FCE8-445A-AE55-ACEDA6534FA1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:x64:*", "matchCriteriaId": "FBF3E8E3-BC4A-4CBA-8859-0AB6393E8A40", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:x64:*", "matchCriteriaId": "FE97605F-7942-435A-9F5B-D51FA19A41AD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*", "matchCriteriaId": "2D3F18AF-84ED-473B-A8DF-65EB23C475AF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*", "matchCriteriaId": "5E491E46-1917-41FE-8F9A-BB0BDDEB42C3", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*", "matchCriteriaId": "0A1BC97A-263E-4291-8AEF-02EE4E6031E9", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network."}, {"lang": "es", "value": "Bucle con condici\u00f3n de salida inalcanzable ('bucle infinito') en .NET, .NET Framework, Visual Studio permite a un atacante no autorizado denegar el servicio a trav\u00e9s de una red."}], "id": "CVE-2026-33116", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33116", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T19:48:26.946135Z", "version": "2.0.3"}}]}, "published": "2026-04-14T18:17:33.903", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:13280"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:13281"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:13282"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:13283"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:13693"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8467"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8468"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8469"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8470"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8471"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8472"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8473"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8474"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8475"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:9077"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:9080"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:9205"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-33116"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457741"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33116.json"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-835"}], "source": "secure@microsoft.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-776"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform", "id": "2457741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457741"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-776", "details": ["A flaw was found in .NET. A remote attacker could exploit this vulnerability by crafting a malicious XML document that triggers an infinite recursion within the XmlDecryptionTransform component. This could lead to a Denial of Service (DoS), making the affected system unresponsive."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-33116", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-04-14T18:38:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33116\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33116"], "statement": "This is an Important denial of service vulnerability in .NET's XmlDecryptionTransform. An attacker could exploit this flaw by providing specially crafted XML data, leading to an infinite recursion and causing a denial of service in applications processing such data. This affects Red Hat Enterprise Linux versions 8, 9, and 10, as well as Fedora.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.6)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": ".NET 10.0", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.0,8.0.26)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": ".NET 8.0", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.26)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": ".NET 8.0", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.15)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": ".NET 9.0", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": ["windows_server_2012", "windows_server_2012_(server_core_installation)", "windows_server_2012_r2", "windows_server_2012_r2_(server_core_installation)"], "status": "affected", "versions": {"scheme": "generic", "value": "3.5.0,2.0.50727.8982 & 3.0.30729.8976"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Microsoft .NET Framework 3.5", "source": "cna", "vendor": "Microsoft"}, "product": ".net_framework", "vendor": "microsoft"}, {"configurations": [{"platform": ["windows_10_version_1809_for_32-bit_systems", "windows_10_version_1809_for_arm64-based_systems", "windows_10_version_1809_for_x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "4.7.0,2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Microsoft .NET Framework 3.5 AND 4.7.2", "source": "cna", "vendor": "Microsoft"}, "product": ".net_framework", "vendor": "microsoft"}, {"configurations": [{"platform": ["windows_10_version_1809_for_32-bit_systems", "windows_10_version_1809_for_arm64-based_systems", "windows_10_version_1809_for_x64-based_systems", "windows_10_version_21h2_for_32-bit_systems", "windows_10_version_21h2_for_arm64-based_systems", "windows_10_version_21h2_for_x64-based_systems", "windows_10_version_22h2_for_32-bit_systems", "windows_10_version_22h2_for_arm64-based_systems", "windows_10_version_22h2_for_x64-based_systems", "windows_server_2022", "windows_server_2022_(server_core_installation)"], "status": "affected", "versions": {"scheme": "generic", "value": "4.8.0,2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Microsoft .NET Framework 3.5 AND 4.8", "source": "cna", "vendor": "Microsoft"}, "product": ".net_framework", "vendor": "microsoft"}, {"configurations": [{"platform": ["windows_10_version_21h2_for_32-bit_systems", "windows_10_version_21h2_for_arm64-based_systems", "windows_10_version_21h2_for_x64-based_systems", "windows_10_version_22h2_for_32-bit_systems", "windows_10_version_22h2_for_arm64-based_systems", "windows_10_version_22h2_for_x64-based_systems", "windows_11_version_22h2_for_arm64-based_systems", "windows_11_version_22h2_for_x64-based_systems", "windows_11_version_23h2_for_arm64-based_systems", "windows_11_version_23h2_for_x64-based_systems", "windows_11_version_24h2_for_arm64-based_systems", "windows_11_version_24h2_for_x64-based_systems", "windows_11_version_25h2_for_arm_systems", "windows_11_version_25h2_for_x64-based_systems", "windows_11_version_26h1_for_arm64-based_systems", "windows_11_version_26h1_for_x64-based_systems", "windows_server_2022", "windows_server_2022_(server_core_installation)", "windows_server_2022,_23h2_edition_(server_core_installation)", "windows_server_2025", "windows_server_2025_(server_core_installation)"], "status": "affected", "versions": {"scheme": "generic", "value": "4.8.1,2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Microsoft .NET Framework 3.5 AND 4.8.1", "source": "cna", "vendor": "Microsoft"}, "product": ".net_framework", "vendor": "microsoft"}, {"configurations": [{"platform": ["windows_server_2012", "windows_server_2012_(server_core_installation)", "windows_server_2012_r2", "windows_server_2012_r2_(server_core_installation)"], "status": "affected", "versions": {"scheme": "generic", "value": "4.7.0,4.8.4801.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "source": "cna", "vendor": "Microsoft"}, "product": ".net_framework", "vendor": "microsoft"}, {"configurations": [{"platform": ["windows_10_version_1607_for_32-bit_systems", "windows_10_version_1607_for_x64-based_systems", "windows_server_2012", "windows_server_2012_(server_core_installation)", "windows_server_2012_r2", "windows_server_2012_r2_(server_core_installation)"], "status": "affected", "versions": {"scheme": "generic", "value": "4.8.0,4.8.4801.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Microsoft .NET Framework 4.8", "source": "cna", "vendor": "Microsoft"}, "product": ".net_framework", "vendor": "microsoft"}], "created": "2026-04-15T15:00:06.172151+00:00", "updated": "2026-06-30T16:15:06.298943+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$.net", "microsoft$PRODUCT$.net_framework"]}