{"uuid": "3ab40ee3-d603-493d-b036-828d1777645b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50651", "type": "seen", "source": "https://gist.github.com/alon710/df65138487c7af20036c193d54f319ac", "content": "# CVE-2026-50651: CVE-2026-50651: Denial of Service via Uncontrolled Resource Allocation in .NET System.Net.Http\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-50651\n\n## Summary\nCVE-2026-50651 is a high-severity Denial of Service vulnerability in Microsoft .NET runtimes, SDKs, and Visual Studio installations. It stems from a weakness in System.Net.Http (CWE-770), where the HTTP/2 connection handling state machine fails to throttle server-initiated protocol streams and control frames. An attacker-controlled server can exploit this by returning highly fragmented or infinite control and continuation frame sequences. This forces the client to allocate memory indefinitely on the managed heap, eventually provoking an unhandled Out-of-Memory (OOM) exception and application crash.\n\n## TL;DR\nUncontrolled resource allocation in .NET's HTTP/2 implementation (System.Net.Http) allows a malicious server to exhaust client heap memory and trigger an Out-of-Memory (OOM) application crash via infinite or highly fragmented protocol frames.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00617 (Percentile: 45.65%)\n- **Impact**: Endpoint Denial of Service (System Resource Exhaustion)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- .NET 10.0 (versions < 10.0.6)\n- .NET 9.0 (versions < 9.0.18)\n- .NET 8.0 (versions < 8.0.29)\n- Microsoft Visual Studio 2022 (version 17.12 < 17.12.22)\n- Microsoft Visual Studio 2022 (version 17.14 < 17.14.36)\n- Microsoft Visual Studio 2026 (version 18.7 < 18.7.4)\n- **.NET 10.0**: < 10.0.6 (Fixed in: `10.0.6`)\n- **.NET 9.0**: < 9.0.18 (Fixed in: `9.0.18`)\n- **.NET 8.0**: < 8.0.29 (Fixed in: `8.0.29`)\n\n## Mitigation\n\n- Upgrade the .NET runtime to version 10.0.6, 9.0.18, 8.0.29, or higher.\n- Enforce HTTP/1.1-only fallback on HttpClient instances when querying third-party or untrusted endpoints.\n- Deploy network IPS/WAF solutions capable of detecting abnormal HTTP/2 frame patterns such as continuous CONTINUATION sequences or rapid PING bursts.\n\n**Remediation Steps:**\n1. Identify all production servers and containerized hosts utilizing vulnerable .NET versions (8.0, 9.0, or 10.0).\n2. Apply the latest July 2026 cumulative security updates via package managers or manual runtime installation.\n3. Re-configure critical outbound HttpClient requests to limit version negotiation where patching is delayed.\n4. Verify system stability and monitor heap memory utilization under test HTTP/2 connections.\n\n## References\n\n- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50651)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-50651)\n- [Wiz Vulnerability Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-50651)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-50651) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T13:31:22.771935Z"}