Bug 2550849 (CVE-2026-84008)

Summary:	CVE-2026-84008 dotnet: .NET Denial of Service Vulnerability
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in .NET. Due to inefficient algorithmic complexity, an unauthorized remote attacker can send specially crafted requests over the network to cause excessive resource consumption. This issue can result in a Denial of Service (DoS), rendering the affected application unresponsive to legitimate users.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2559910, 2559911, 2559912
Bug Blocks:

Description OSIDB Bzimport 2026-10-13 19:27:53 UTC

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Affected packages:
- System.Security.Cryptography.Pkcs (release 9.0): 9.0.0 - 9.0.20; fixed 9.0.21
- System.Security.Cryptography.Pkcs (release 11.0): 11.0.0-preview.1 - 11.0.0-rc.1; fixed 11.0.0-rc.2
- System.Security.Cryptography.Pkcs (release 10.0): 10.0.0 - 10.0.12; fixed 10.0.13
- System.Security.Cryptography.Pkcs (release 8.0): 8.0.0 - 8.0.1; fixed 8.0.2