Microsoft .NET: Denial of Service through inefficient algorithmic complexity
Summary
Inefficient algorithmic complexity in Microsoft .NET 11.0 allows an unauthenticated remote attacker to cause a denial of service. The CNA lists .NET 11.0 on Windows, macOS and Linux, and System.Text.Json, as affected. The attack needs no privileges or user interaction, and only availability is affected according to the CNA vector. The CVSS score of 5.3 comes from the CNA record, and NVD analysis was still pending at the time of writing.
Affected
- Microsoft .NET 11.0 installed on Linux: 11.0.0-preview.1 to < 11.0.0
- Microsoft .NET 11.0 installed on macOS: 11.0.0-preview.1 to < 11.0.0
- Microsoft .NET 11.0 installed on Windows: 11.0.0-preview.1 to < 11.0.0
- Microsoft System.Text.Json: NOT_YET_AVAILABLE to < 11.0.0
- Older .NET versions (for example .NET 8 and 9): not confirmed, check the Microsoft advisory
Fixed in
Unknown. Fixed version numbers were not available in the sources reviewed. See the Microsoft Security Update Guide for the patched versions.
Workaround
Unknown. No workaround was found; applying the Microsoft update is the expected remedy.
Exploitation
- Not known to be exploited in the wild.
- SANS ISC and Rapid7 list the vulnerability as not publicly disclosed.
- No public proof of concept was found.
Our recommendation
- Inventory all .NET runtimes and SDKs on servers, containers, build images and Linux or macOS hosts.
- Apply Microsoft's updates for the affected .NET 11 packages once the fixed versions are confirmed on the MSRC page.
- Prioritise internet-facing .NET 11 applications, such as web APIs and portals.
- Monitor for changes in exploitation status and for any public proof of concept.
- Note the conflicting CVSS figures (Rapid7 cites 6.5) and check NVD once analysis is complete.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-120796 msrc.microsoft.com
- dotnet announcements: November 2026 .NET runtime security update github.com
- dotnet announcements: CVE-2026-120796 guidance github.com
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- SANS ISC: Patch Tuesday diary isc.sans.edu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:27.
Original description (NVD)
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.