Medium 5.3

Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability

CVE-2026-120796 First seen on SecPulse 03:21

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Microsoft	Microsoft.NET 11.0 installed on Linux	≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0	11.0.0
Microsoft	Microsoft.NET 11.0 installed on Mac OS	≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0	11.0.0
Microsoft	Microsoft.NET 11.0 installed on Windows	≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0	11.0.0
Microsoft	MicrosoftSystem.Text.Json	≥ NOT_YET_AVAILABLE, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-arm	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-musl-arm	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-musl-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-musl-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.linux-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.osx-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.osx-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.win-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.win-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.NETCore.App.Runtime.win-x86	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetSystem.Text.Json	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0

Original description The description as published by the source.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/499

CVSS Details

Version: 3.1
Severity: Medium
Score: 5.3 (base score)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Weakness: CWE-407

Affected Platforms

Platforms: Windows, Linux, macOS
Architectures: All

Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package	Affected version	Patched version
Microsoft.NETCore.App.Runtime.linux-arm	>= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148	11.0.0
Microsoft.NETCore.App.Runtime.linux-arm64	>= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148	11.0.0
Microsoft.NETCore.App.Runtime.linux-musl-arm	>= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.1…

Source: Microsoft Security Response Center Blog NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Published: Nov 11, 2026
First seen on SecPulse: 03:21
GHSA: GHSA-cpw3-h88j-9f6x
CWE: CWE-407

NVD GitHub Advisory

Tags(click for explanation)

Vendors

Microsoft

All

Msrc CWE-407 Net 110 Installed On Linux Net 110 Installed On Mac Os Net 110 Installed On Windows Systemtextjson

Programming Languages

Attack Types

Denial of Service

Detection sources

OSV.dev (Open Source Vulnerabilities)08:30
NIST National Vulnerability Database04:20
Microsoft Security Response Center Blog03:21
CVE.org (CVE Program・cvelistV5)08:55