CVE-2026-42899

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Score

CVSS 3.1 7.5 High

Status

Modified - secure@microsoft.com

Published

2026-05-12

Last modified

2026-10-26

Weaknesses

CWE-835

Affected products

• .net (Microsoft)
• Enterprise Linux (Redhat)
• Enterprise Linux Eus (Redhat)
• Hummingbird (Redhat)
• Rhel E4s (Redhat)
• Rhel Eus (Redhat)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899
• https://access.redhat.com/security/cve/CVE-2026-42899
• https://bugzilla.redhat.com/show_bug.cgi?id=2476605
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42899.json
• https://access.redhat.com/errata/RHSA-2026:24332
• https://access.redhat.com/errata/RHSA-2026:24333
• https://access.redhat.com/errata/RHSA-2026:22145
• https://access.redhat.com/errata/RHSA-2026:21286
• https://access.redhat.com/errata/RHSA-2026:21754
• https://access.redhat.com/errata/RHSA-2026:21295
• https://access.redhat.com/errata/RHSA-2026:21291
• https://access.redhat.com/errata/RHSA-2026:21294
• https://access.redhat.com/errata/RHSA-2026:24334
• https://access.redhat.com/errata/RHSA-2026:24335
• https://access.redhat.com/errata/RHSA-2026:24336
• https://access.redhat.com/errata/RHSA-2026:21297
• https://access.redhat.com/errata/RHSA-2026:21293
• https://access.redhat.com/errata/RHSA-2026:21296
• https://access.redhat.com/errata/RHSA-2026:17464
• https://access.redhat.com/errata/RHSA-2026:17682
• https://access.redhat.com/errata/RHSA-2026:17527