CVE-2026-109475

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-109475) has been identified in the managed implementation of HttpListener, the built-in HTTP server class, which .NET uses on Linux and macOS. An unauthenticated remote client that sends a request line that never ends can exhaust the stack and terminate the process. Windows, where HttpListener is built on the HTTP.sys kernel driver, is not affected.

Per CWE-674: Uncontrolled Recursion, the product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Microsoft's advisory assigns CWE-121: Stack-based Buffer Overflow; its impact rating is availability only.

This issue affects .NET 6.0.48 or earlier, 8.0.33 or earlier, 9.0.22 or earlier, 10.0.14 or earlier and 11.0 previews and release candidates, on Linux and macOS; HeroDevs investigation confirmed .NET 6 has the same code. Only applications that accept connections through System.Net.HttpListener are exposed; ASP.NET Core applications served by Kestrel do not use it.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET Runtime
• Affected packages: Microsoft.NETCore.App on Linux and macOS (in-box; runtime packs Microsoft.NETCore.App.Runtime.linux-*, linux-musl-*, osx-*)
• Affected versions:
  • >= 6.0.0, <= 6.0.48
  • >= 8.0.0-0, <= 8.0.33
  • >= 9.0.0-0, <= 9.0.22
  • >= 10.0.0-0, <= 10.0.14
  • >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet, Docker
• Fixed in: OSS .NET Runtime 8.0.34, 9.0.23, 10.0.15, 11.0.0; NES for .NET 6.0.49

Vulnerability Info

This High-severity vulnerability is found in the managed HttpListener implementation in System.Net.HttpListener, part of the Microsoft.NETCore.App shared framework on Linux and macOS.

Each connection is read through a chain of asynchronous BeginRead calls in HttpConnection. The read callback parses what arrived and, while the request line and headers are still incomplete, starts the next read. When data is already waiting on the socket, that read completes synchronously and its callback runs on the same thread, nested inside the previous one. A client that keeps sending bytes without ever ending the request line keeps the request incomplete and the callbacks nesting, so the stack grows with every read until it overflows. A stack overflow cannot be caught in .NET, so the process terminates along with every request it was serving.

The fix replaces the recursive callback chain with a loop that handles synchronously completed reads in place, removes the same recursion from the chunked request-body readers, and enforces the 64 KiB request-header limit cumulatively across the request line and all headers.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  • .NET Runtime >= 8.0.34
  • .NET Runtime >= 9.0.23
  • .NET Runtime >= 10.0.15
  • .NET Runtime >= 11.0.0
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later.

Credits

Microsoft's security advisory acknowledges Rolf Zengaffinen, DEVENDRA KUMAR SINHA, Leandro Batista, Kevin Schmidt and an anonymous contributor.