CVE-2026-62901: CWE-606: Unchecked Input for Loop Condition in Microsoft .NET 10.0
CVE-2026-62901 is a high-severity vulnerability in Microsoft .NET 10.0 involving unchecked input for a loop condition. This flaw allows an unauthenticated attacker to cause a denial of service (DoS) over a network by exploiting the System.Net.WebSockets component. The vulnerability impacts service availability and reliability but does not affect confidentiality or integrity. An official fix is available and has been released by Red Hat for affected products. No known exploits are currently reported in the wild.
AI Analysis
Technical Summary
CVE-2026-62901 is a denial of service vulnerability caused by unchecked input for a loop condition in the System.Net.WebSockets component of Microsoft .NET 10.0. An unauthenticated attacker can exploit this flaw remotely to cause resource exhaustion, leading to service disruption. The vulnerability has a CVSS v3.1 base score of 7.5 (high severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Red Hat has issued an official fix for affected products, including Red Hat Hardened Images using .NET 9.0 and newer. The vulnerability is tracked under CWE-606 (Unchecked Input for Loop Condition).
Potential Impact
The vulnerability allows an unauthenticated attacker to remotely cause a denial of service by triggering resource consumption in the affected .NET applications, impacting availability and reliability. There is no impact on confidentiality or integrity. No known exploits are currently active in the wild.
Mitigation Recommendations
An official fix is available and has been released by Red Hat for affected products. Users should apply the provided updates to remediate the vulnerability. No alternative mitigations meeting Red Hat's criteria are currently available. Since the fix is official and available, urgent application of the patch is recommended to prevent denial of service.
CVE-2026-62901: CWE-606: Unchecked Input for Loop Condition in Microsoft .NET 10.0
Description
CVE-2026-62901 is a high-severity vulnerability in Microsoft .NET 10.0 involving unchecked input for a loop condition. This flaw allows an unauthenticated attacker to cause a denial of service (DoS) over a network by exploiting the System.Net.WebSockets component. The vulnerability impacts service availability and reliability but does not affect confidentiality or integrity. An official fix is available and has been released by Red Hat for affected products. No known exploits are currently reported in the wild.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-62901 is a denial of service vulnerability caused by unchecked input for a loop condition in the System.Net.WebSockets component of Microsoft .NET 10.0. An unauthenticated attacker can exploit this flaw remotely to cause resource exhaustion, leading to service disruption. The vulnerability has a CVSS v3.1 base score of 7.5 (high severity) with network attack vector, low complexity, no privileges required, and no user interaction needed. Red Hat has issued an official fix for affected products, including Red Hat Hardened Images using .NET 9.0 and newer. The vulnerability is tracked under CWE-606 (Unchecked Input for Loop Condition).
Potential Impact
The vulnerability allows an unauthenticated attacker to remotely cause a denial of service by triggering resource consumption in the affected .NET applications, impacting availability and reliability. There is no impact on confidentiality or integrity. No known exploits are currently active in the wild.
Mitigation Recommendations
An official fix is available and has been released by Red Hat for affected products. Users should apply the provided updates to remediate the vulnerability. No alternative mitigations meeting Red Hat's criteria are currently available. Since the fix is official and available, urgent application of the patch is recommended to prevent denial of service.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:44914
- Cve Count
- 1
- Remediation Level
- official-fix
- State
- PUBLISHED
Threat ID: 6a7c9b69bf8831d539cdf69c
Added to database: 08/12/2026, 16:12:25 UTC
Last enriched: 09/10/2026, 22:59:22 UTC
Last updated: 09/25/2026, 19:48:49 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.