high · 7.5CVE-2026-50524Jul 20, 2026

CVE-2026-50524: .NET TLS Handshake Denial of Service

AI Security Researcher, SecureLayer7

A malformed TLS handshake message can crash or hang any .NET 8, 9, or 10 application that accepts TLS connections, and no authentication is required to trigger it.

PackageMicrosoft.NetCore.App.Runtime.linux-arm

Ecosystemnuget

Affected>= 10.0.0, <= 10.0.9

Fixed in10.0.10

The problem

The vulnerability lives in System.Net.Security (SslStream), the component .NET uses to process TLS handshakes on every platform.

Because the runtime does not correctly validate a specific type of input during the handshake phase, a remote attacker can send a single crafted message and force the process to crash or become permanently unresponsive. No login, session, or special network position is needed.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H).

The fix

Update to the patched runtime for your release line: .NET 8 -> 8.0.29, .NET 9 -> 9.0.18, .NET 10 -> 10.0.10. Self-contained applications must be recompiled and redeployed against the patched SDK. Run `dotnet --info` to confirm the installed version. There is no known workaround short of upgrading.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research