CVE-2026-62901: Remote Denial of Service via Infinite Loop in .NET WebSockets Engine

CVE-2026-62901 is a critical vulnerability within the .NET runtime ecosystem affecting core networking capabilities. Specifically, the flaw resides in the System.Net.WebSockets frame-processing state machine and the accompanying network transport libraries. This vulnerability allows unauthenticated remote attackers to trigger an infinite loop inside the target host process, leading to resource exhaustion.

The vulnerability impacts services utilizing WebSockets for real-time bidirectional communication, such as SignalR applications, custom WebSocket servers, and APIs upgraded to HTTP/2 or HTTP/3. It is classified under CWE-606 (Unchecked Input for Loop Condition). The severity of the flaw is heightened because it requires no specialized privileges or user interaction to exploit.

Furthermore, the vulnerability extends into the native MsQuic library, which is the underlying transport mechanism for HTTP/3 in .NET. A parallel parsing issue in native frame processing could similarly be triggered by malformed packets over QUIC. This multi-layered impact makes it necessary to remediate both the managed-code framework and the associated native binary dependencies.

The root cause of the vulnerability lies in the input-handling logic of the managed WebSocket frame parser. When a WebSocket connection is established, incoming data frames are analyzed to extract control flags, masking keys, and the declared payload length. The frame parsing mechanism operates via a loop that reads incoming bytes iteratively to satisfy the length declared in the frame header.

In vulnerable versions of the framework, the frame parser uses the declared payload length from the WebSocket header as the primary loop termination metric. If the client stops transmitting data abruptly, or terminates the connection, the underlying Stream.ReadAsync call returns 0 bytes, signifying an End-of-Stream (EOF) state. However, the parsing loop fails to validate this return value.

Because the loop logic does not verify whether the read operation actually yielded a non-zero number of bytes, it continues to execute. The counter tracking remaining bytes to be read (remainingBytes) is never decremented because no data is received. This creates an unyielding execution pattern where the loop executes indefinitely with a read result of 0 bytes.

Analyzing the vulnerable execution flow reveals the absence of a crucial check on the return value of the asynchronous read stream. In the unpatched implementation of the frame parser, the read loop is structured to continuously pull data from the network stream until the expected payload size is fulfilled.

Below is a conceptual representation of the vulnerable code segment:

// Vulnerable frame reading loop
while (remainingBytes > 0)
{
    // The return value 'read' is not checked for 0 (EOF)
    int read = await _stream.ReadAsync(buffer, cancellationToken);
    
    // Process the buffer...
    remainingBytes -= read; // If read is 0, remainingBytes never decreases
}

The official patch remediated this vulnerability by validating the byte count returned from the read operation. If ReadAsync returns 0 while there are still expected bytes to read, the routine immediately aborts, throws a WebSocketException, and terminates the connection. This prevents the execution thread from spinning in an infinite loop.

// Patched frame reading loop
while (remainingBytes > 0)
{
    int read = await _stream.ReadAsync(buffer, cancellationToken);
    if (read == 0)
    {
        // Explicitly check for End-of-Stream (EOF)
        throw new WebSocketException(WebSocketError.ConnectionClosedPrematurely);
    }
    
    // Process the buffer...
    remainingBytes -= read;
}

Exploitation of CVE-2026-62901 relies on sending a crafted network payload that triggers the loop condition without providing the bytes to satisfy it. An attacker begins by initiating a standard HTTP/1.1 or HTTP/2 GET request to upgrade the connection to WebSockets. This process requires no pre-existing authentication, allowing any network-adjacent attacker to reach the vulnerable handler.

Once the WebSocket handshake completes, the attacker transmits a specifically structured WebSocket frame header. This header specifies an artificially inflated payload length, often utilizing the extended 64-bit length descriptor to indicate several gigabytes of expected data. Immediately after transmitting the header, the attacker terminates transmission or half-closes the TCP socket.

As a result, the server-side buffer reaches an EOF state. The System.Net.WebSockets parsing engine continues to poll the closed socket stream, receiving 0 bytes in return. The parsing loop enters the infinite execution state, utilizing 100% of the host CPU core assigned to that thread. By executing multiple parallel connections of this type, an attacker can consume all threads in the thread pool, completely freezing the target web server.

When .NET applications run WebSockets over HTTP/3 (under RFC 9220), they rely on the native library MsQuic for stream transport. A parallel bug existed in the native frame processing layer of MsQuic, where unvalidated frame boundary checks could also cause an infinite loop in the native transport driver.

To fully address this vector, Microsoft updated the native dependency version of MsQuic within the .NET SDK build properties. Specifically, the build configuration eng/Versions.props was patched to bump MicrosoftNativeQuicMsQuicSchannelVersion from version 2.4.18 to 2.5.9.

Consequently, developers compiling applications as self-contained deployments must ensure they compile using the updated SDK. Otherwise, the output binary bundle may still carry the vulnerable version of the native msquic.dll or libmsquic.so library, leaving the deployment exposed to the native loop vulnerability even if the managed libraries are updated.

The primary and most effective remediation path is upgrading the .NET runtime to the latest security releases. System administrators must deploy updates for .NET 10.0.11, 9.0.19, or 8.0.30 depending on the major version of their environment. Similarly, development environments using Visual Studio 2022 or Visual Studio 2026 must be updated to version 17.14.38 or 18.8.3 respectively.

In scenarios where immediate patching is not feasible, network-level controls should be implemented. Reverse proxies, such as YARP, NGINX, or IIS, can be configured to enforce strict limits on the number of concurrent WebSocket connections from single source IP addresses. Applying aggressive write and read timeouts at the proxy level can also force-terminate stalled connections before they exhaust server threads.

Additionally, security teams should implement monitoring alerts for rapid, abnormal increases in CPU utilization on .NET hosts. Monitoring tools can track thread pool exhaustion indicators and abnormally long-lived WebSocket sessions that exhibit zero throughput. These metrics can help identify ongoing denial of service attempts in real time.