中 5.3

Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability

CVE-2026-120796 SecPulse初出 3:21

影響パッケージ

種類	パッケージ	影響を受ける版 → 修正版	修正版
Microsoft	Microsoft.NET 11.0 installed on Linux	11.0.0-preview.1 以上 11.0.0 未満→ 11.0.0	11.0.0
Microsoft	Microsoft.NET 11.0 installed on Mac OS	11.0.0-preview.1 以上 11.0.0 未満→ 11.0.0	11.0.0
Microsoft	Microsoft.NET 11.0 installed on Windows	11.0.0-preview.1 以上 11.0.0 未満→ 11.0.0	11.0.0
Microsoft	MicrosoftSystem.Text.Json	NOT_YET_AVAILABLE 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-arm	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-arm64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-musl-arm	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-musl-arm64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-musl-x64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-x64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.osx-arm64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.osx-x64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.win-arm64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.win-x64	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.win-x86	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0
NuGet	NuGetSystem.Text.Json	11.0.0-preview.1.26104.118 以上 11.0.0 未満→ 11.0.0	11.0.0

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/499

CVSS Details

Version: 3.1
Severity: Medium
Score: 5.3 (base score)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Weakness: CWE-407

Affected Platforms

Platforms: Windows, Linux, macOS
Architectures: All

Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package	Affected version	Patched version
Microsoft.NETCore.App.Runtime.linux-arm	>= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148	11.0.0
Microsoft.NETCore.App.Runtime.linux-arm64	>= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148	11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-arm	>= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.1…

出典: Microsoft Security Response Center Blog NVD GitHub Advisory