CVE Watch10 de ago. de 2026

CVE-2023-38180

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

CVSS

7.5

Alta

EPSS

14.1%

p97

KEV

SIM

9 de ago. de 2023

Exploit Today

0-100

Publicado: 8 de ago. de 2023 · Última mod.: 10 de ago. de 2026 · CWE-400

EPSS · 30d

14.0%EPSS · 30 dias14.1%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Microsoft / .NET Core and Visual Studio

Vulnerabilidade

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

Adicionado ao KEV

9 de ago. de 2023

Corrigir até

30 de ago. de 2023

Uso conhecido em ransomware

Não

Descrição resumida

Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180; https://nvd.nist.gov/vuln/detail/CVE-2023-38180

Descrição técnica

.NET and Visual Studio Denial of Service Vulnerability

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-829657.5 ALT

—

——0A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.7h CVE-2026-494077.7 ALT

—

——0OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.9h CVE-2026-1109327.5 ALT

—

——0A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.7h CVE-2026-1071237.5 ALT

—

——0A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.9h CVE-2026-74841—

—

——0In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.11h CVE-2026-33971—

7.6%

——2In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.23h