CVE-2026-84008
Fixed in a distro release EPSS <1%CVSS 7.5
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Products: Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8, Microsoft .NET Framework 4.8.1, Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, Microsoft System.Security.Cryptography.Pkcs
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | System.Security.Cryptography.Pkcs | 10.0.13 |
| NuGet | System.Security.Cryptography.Pkcs | 11.0.0-rc.2 |
| NuGet | System.Security.Cryptography.Pkcs | 8.0.2 |
| NuGet | System.Security.Cryptography.Pkcs | 9.0.21 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner | 2.338.0-r2 |
| Chainguard | dotnet-10-sdk | 10.0.113-r1 |
| Chainguard | dotnet-8-sdk | 8.0.132-r0 |
| Chainguard | dotnet-9-sdk | 9.0.122-r0 |
| Chainguard | dotnet-bootstrap-8 | no fix |
| Chainguard | dotnet-bootstrap-9 | no fix |
| Chainguard | dotnet-sdk-10.0.2 | 10.0.204-r9 |
| Chainguard | dotnet-sdk-10.0.3 | 10.0.303-r7 |
| Chainguard | dotnet-sdk-10.0.4 | 10.0.402-r0 |
| Chainguard | dotnet-sdk-stage0-10 | 10.0.113-r0 |
| Chainguard | eco-dotnet-apidiff | 0.1.7-r0 |
| Chainguard | ilspycmd | 11.1-r1 |
| Chainguard | promitor | 2.16.1-r1 |
| Ubuntu 22.04 LTS | dotnet6 | no fix |
| Ubuntu 22.04 LTS | dotnet7 | no fix |
| Ubuntu 22.04 LTS | dotnet8 | 8.0.132-8.0.32-0ubuntu1~22.04.1 |
| Ubuntu 24.04 LTS | dotnet10 | 10.0.113-10.0.13-0ubuntu1~24.04.1 |
| Ubuntu 24.04 LTS | dotnet8 | 8.0.132-8.0.32-0ubuntu1~24.04.1 |
| Ubuntu 26.04 LTS | dotnet10 | 10.0.113-10.0.13-0ubuntu1~26.04.1 |
| Ubuntu 26.10 | dotnet10 | 10.0.113-10.0.13-0ubuntu1~26.10.1 |
| Ubuntu 26.10 | dotnet11 | 11.0.100-11.0.0~rc2-0ubuntu1~26.10.1 |
| Wolfi | dotnet-10-sdk | 10.0.113-r1 |
| Wolfi | dotnet-8-sdk | 8.0.132-r0 |
| Wolfi | dotnet-9-sdk | 9.0.122-r0 |
| Wolfi | dotnet-bootstrap-8 | no fix |
| Wolfi | dotnet-bootstrap-9 | no fix |
| Wolfi | dotnet-sdk-10.0.2 | 10.0.204-r9 |
| Wolfi | dotnet-sdk-10.0.3 | 10.0.303-r7 |
| Wolfi | dotnet-sdk-10.0.4 | 10.0.402-r0 |
| Wolfi | dotnet-sdk-stage0-10 | 10.0.113-r0 |
| Wolfi | ilspycmd | 11.1-r1 |
| Wolfi | promitor | 2.16.1-r1 |