CVE-2026-118747

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-118747) has been identified in System.Formats.Cbor, the .NET library for the CBOR (Concise Binary Object Representation) data format. An unauthenticated attacker who can supply CBOR containing a map with many colliding keys can make the reader's duplicate-key check consume excessive CPU, stalling the application.

Per CWE-407: Inefficient Algorithmic Complexity, an algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Microsoft lists the 8.0, 9.0, 10.0 and 11.0 package lines as affected; HeroDevs investigation found the same code in the .NET 6 package. System.Formats.Cbor is not part of the shared framework. It ships as an opt-in NuGet package, so only applications that reference it, directly or as an indirect dependency, and read untrusted CBOR are exposed. Updating the runtime alone does not fix it; update the package reference, then rebuild and redeploy.

Details

Module Info

• Product: .NET
• Affected packages: System.Formats.Cbor (opt-in NuGet package)
• Affected versions:
  • System.Formats.Cbor >= 6.0.0, < 6.0.0.2
  • System.Formats.Cbor >= 8.0.0-0, < 8.0.2
  • System.Formats.Cbor >= 9.0.0-0, < 9.0.24
  • System.Formats.Cbor >= 10.0.0-0, < 10.0.15
  • System.Formats.Cbor >= 11.0.0-0, < 11.0.0
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: System.Formats.Cbor on NuGet
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.49 (System.Formats.Cbor 6.0.0.2)

Vulnerability Info

This High-severity vulnerability is found in the CborReader type of the System.Formats.Cbor package, in versions before 6.0.0.2 (NES), 8.0.2, 9.0.24, 10.0.15 and 11.0.0.

In the Strict (default), Canonical and Ctap2Canonical conformance modes, CBOR maps must not repeat a key. To enforce that, CborReader adds the encoded bytes of each key it reads to a hash set and rejects the map when a key is already present. The set's hash came from System.HashCode over each key's encoding. Microsoft's advisory states that colliding map keys can hash-flood this uniqueness check: when many keys share a hash, each new key is compared against every earlier one, so the work to read one map grows quadratically with the number of colliding keys. CborConformanceMode.Lax does not check for duplicate keys and does not reach this path.

The fix hashes key encodings with Marvin, the randomized hash .NET already uses for strings, seeded per process. NES System.Formats.Cbor 6.0.0.1, which NES for .NET 6.0.47 shipped with a nesting-depth limit for map keys, does not address this issue.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  • System.Formats.Cbor >= 8.0.2
  • System.Formats.Cbor >= 9.0.24
  • System.Formats.Cbor >= 10.0.15
  • System.Formats.Cbor >= 11.0.0
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later, which ships System.Formats.Cbor 6.0.0.2.

Credits

Anonymous