CVE-2026-57108

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-57108) has been identified in .NET's X.509 certificate name parsing on Unix (the native OpenSSL platform abstraction layer), which allows attackers to crash an application that reads a UPN (User Principal Name) from an attacker-supplied certificate. Windows, which uses the CNG cryptography backend, is not affected.

Per CWE-843: Access of Resource Using Incompatible Type ('Type Confusion'),  type confusion occurs when a product allocates or initializes a resource such as a pointer, object, or variable using one type, but later accesses that resource using a type that is incompatible with the original type.

This issue affects multiple versions of .NET, including the End-of-Life .NET 6.0 line covered by NES.

‍

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.NETCore.App (the .NET shared framework / runtime pack; the native System.Security.Cryptography.Native OpenSSL shim ships in-box on Linux and macOS, not as an opt-in NuGet package)
• Affected versions: >= 6.0.0 <= 6.0.42
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the native OpenSSL platform abstraction layer of the Microsoft.NETCore.App shared framework (the System.Security.Cryptography.Native shim) on Linux and macOS. When resolving a UPN from a certificate's subjectAltName otherName entry, the native CryptoNative_GetX509NameInfo function reads the otherName value, an ASN1_TYPE tagged union, as a string after only a NULL check:

// OTHERNAME->ASN1_TYPE->union.field
if (!value->value)
{
    return NULL;
}

str = value->value->value.asn1_string;

value->value is an ASN1_TYPE whose active union member depends on its type tag. The code assumes a string type and reads value.asn1_string, but a crafted certificate can carry a UPN otherName whose value has a non-string ASN.1 type (for example V_ASN1_BOOLEAN, whose union member is an int). In that case a small integer is reinterpreted as an ASN1_STRING pointer and later dereferenced when the name is printed, causing a type-confusion crash. The value is reached whenever an application calls X509Certificate2.GetNameInfo(X509NameType.UpnName, ...) on an attacker-supplied certificate, such as a client certificate presented during mutual TLS or any certificate-to-identity mapping over untrusted input. Every .NET 6 application on Linux or macOS that inspects UPN names on untrusted certificates is exposed.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  •  .NET Runtime >= 8.0.29
  •  .NET Runtime >= 9.0.18
  • .NET Runtime >= 10.0.10
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍

Credits

Microsoft did not publicly credit an individual finder for this vulnerability in its security advisory.