CVE-2026-33116

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

State: Published
Severity: 7.5 High
Published: Apr 14, 2026
Updated: Oct 15, 2026
Reserved: Mar 17, 2026

Description

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	microsoft
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat-SADP

Weaknesses

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-400 Uncontrolled Resource Consumption
CWE-20 Improper Input Validation
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected Products

Product	Versions
.NET 10.0Microsoft	10.0.0 to before 10.0.6Affected
.NET 8.0Microsoft	8.0 to before 8.0.26Affected
.NET 8.0Microsoft	8.0.0 to before 8.0.26Affected
.NET 9.0Microsoft	9.0.0 to before 9.0.15Affected
Microsoft .NET Framework 3.5Microsoft	3.5.0 to before 2.0.50727.8982 & 3.0.30729.8976Affected
Microsoft .NET Framework 3.5 AND 4.7.2Microsoft	4.7.0 to before 2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0Affected
Microsoft .NET Framework 3.5 AND 4.8Microsoft	4.8.0 to before 2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0Affected
Microsoft .NET Framework 3.5 AND 4.8.1Microsoft	4.8.1 to before 2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0Affected
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2Microsoft	4.7.0 to before 4.8.4801.0Affected
Microsoft .NET Framework 4.8Microsoft	4.8.0 to before 4.8.4801.0Affected

References

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerabilityvendor-advisorypatch
https://access.redhat.com/security/cve/CVE-2026-33116vdb-entry
RHBZ#2457741issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33116.json
https://access.redhat.com/errata/RHSA-2026:13281vendor-advisory
https://access.redhat.com/errata/RHSA-2026:13280vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8467vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8470vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8472vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8473vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8468vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8475vendor-advisory
https://access.redhat.com/errata/RHSA-2026:13693vendor-advisory
https://access.redhat.com/errata/RHSA-2026:13283vendor-advisory
https://access.redhat.com/errata/RHSA-2026:13282vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8471vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8469vendor-advisory
https://access.redhat.com/errata/RHSA-2026:8474vendor-advisory
https://access.redhat.com/errata/RHSA-2026:9077vendor-advisory
https://access.redhat.com/errata/RHSA-2026:9080vendor-advisory
https://access.redhat.com/errata/RHSA-2026:9205vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.