undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
Products covered
System.Security.Cryptography.Xml on .NET 10.0 installed on Windows
System.Security.Cryptography.Xml on .NET 10.0 installed on Linux
System.Security.Cryptography.Xml on .NET 10.0 installed on Mac OS
System.Security.Cryptography.Xml on .NET 11.0 installed on Windows
System.Security.Cryptography.Xml on .NET 11.0 installed on Linux
System.Security.Cryptography.Xml on .NET 11.0 installed on Mac OS
System.Security.Cryptography.Xml on .NET 8.0 installed on Windows
System.Security.Cryptography.Xml on .NET 8.0 installed on Linux
Show 31 more products
System.Security.Cryptography.Xml on .NET 8.0 installed on Mac OS
System.Security.Cryptography.Xml on .NET 9.0 installed on Windows
System.Security.Cryptography.Xml on .NET 9.0 installed on Linux
System.Security.Cryptography.Xml on .NET 9.0 installed on Mac OS
Microsoft .NET Framework 3.5 on Windows 11 version 26H1
Microsoft .NET Framework 3.5 on Windows Server 2012
Microsoft .NET Framework 3.5 on Windows Server 2012 R2
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
Microsoft .NET Framework 4.8 on Windows 10 version 1607
Microsoft .NET Framework 4.8 on Windows Server 2012
Microsoft .NET Framework 4.8 on Windows Server 2012 R2
Microsoft .NET Framework 4.8 on Windows Server 2016
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
Remediation
Release Notes Install KB5127696. Install KB5127660. Install KB5127664. Install KB5126868. Install KB5127666. Install KB5127685. Install KB5127683. Install KB5127687. Install KB5127667. Install KB5127668. Install KB5127684. Install KB5127686. Install KB5127688. Install KB5127689. Install KB5127690. Install KB5127691. Install KB5127692. Install KB5127693. Install KB5127694.
Vendor-listed fixes
10.0.13
11.0.0-rc.2
8.0.5
9.0.21
2.0.50727.9188 AND 3.0.30729.9171
2.0.50727.8987 AND 3.0.30729.8982
2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Show 7 more fixes
2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0
4.7.4150.0
4.8.4811.0
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
4.8.9363.0
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0
CVEs in this advisory 1
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.