EOL Fix Available | CVE-2026-50651

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-50651) has been identified in the .NET HttpClient HTTP/2 client (the SocketsHttpHandler Http2Connection), which allows a malicious or compromised HTTP/2 server to exhaust the memory of a client application and crash it. This is a flaw in the outbound client stack, not in the Kestrel server.

Per CWE-770: Allocation of Resources Without Limits or Throttling, the product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

This issue affects multiple versions of .NET, including the End-of-Life .NET 6.0 line covered by NES.

‍

Details

Module Info

Product: .NET
Affected packages: Microsoft.NETCore.App (the .NET shared framework / runtime pack; System.Net.Http is built into the runtime, not an opt-in NuGet package)
Affected versions: >= 6.0.0 <= 6.0.42
GitHub repository: https://github.com/dotnet/runtime
Published packages: Download .NET (Linux, macOS, and Windows)
Package manager: NuGet
Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the HTTP/2 client of the Microsoft.NETCore.App shared framework (System.Net.Http, SocketsHttpHandler) in multiple versions of .NET. This is the outbound HttpClient client stack that an application uses to make requests, not the Kestrel server that receives them. The HTTP/2 connection sends its outbound frames through an unbounded write channel, and it answers each inbound SETTINGS or PING frame by queuing an acknowledgement write in a fire-and-forget manner, with no limit on how many acknowledgements may be outstanding:

_writeChannel = Channel.CreateUnbounded<WriteQueueEntry>(s_channelOptions);
// ...
LogExceptions(SendSettingsAckAsync());
// ...
LogExceptions(SendPingAsync(pingContentLong, isAck: true));

A malicious or compromised HTTP/2 server that the client connects to can flood the connection with SETTINGS and PING frames while deliberately not reading from its socket. Each inbound frame causes the client to enqueue another acknowledgement write; because the server is not reading, TCP backpressure prevents those writes from draining, so the queued entries accumulate in the unbounded channel without limit until the client process exhausts memory and crashes. No special configuration is required: this is default SocketsHttpHandler behavior for any application that makes outbound HTTP/2 requests to an untrusted endpoint, such as a webhook target, a federation peer, a proxy, or a crawler destination.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- .NET Runtime >= 8.0.29
- .NET Runtime >= 9.0.18
- .NET Runtime >= 10.0.10
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍