high · 7.5CVE-2026-57108Jul 20, 2026

CVE-2026-57108: .NET Runtime X.509 Certificate Parsing Denial of Service

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A specially crafted X.509 certificate can crash .NET 8, 9, and 10 runtimes on Linux and macOS by triggering a type confusion bug in the native certificate name-info lookup, making any service that par

PackageMicrosoft.NetCore.App.Runtime.linux-arm
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.9
Fixed in10.0.10

The problem

The vulnerability lives in `CryptoNative_GetX509NameInfo`, a native C shim in the .NET OpenSSL PAL layer that retrieves subject/issuer name fields from an X.509 certificate.

When the runtime calls this function on a malformed certificate, an ASN.1 value of the wrong string type is passed to an underlying OpenSSL routine that expects a specific type. The resulting type confusion (CWE-843) causes a process crash, producing a remotely-triggerable denial of service with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N).

The bug is platform-specific: only the Linux and macOS runtimes use this OpenSSL-backed native path. Windows is not affected because it uses a separate CNG/CAPI code path.

The fix

Update the .NET runtime to a patched release: .NET 10 users should upgrade to 10.0.10, .NET 9 users to 9.0.18, and .NET 8 users to 8.0.29. Self-contained applications must be recompiled against a patched SDK and redeployed. Run `dotnet --info` to confirm the installed version.

Applications that parse untrusted X.509 certificates (TLS servers, certificate validators, OCSP/CRL processors) are highest priority for patching.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research