AIKIDO-2026-601590
Microsoft.Diagnostics.Tracing.TraceEvent is vulnerable to Denial of Service (DoS)
55
Medium Risk
This Affects:
Microsoft.Diagnostics.Tracing.TraceEventTL;DR
The EventPipe trace parser reads a 32-bit object type length from the input stream and passes it to a stack allocation. The value is only validated against an upper bound, so a negative length bypasses the check and is treated as an enormous allocation size. Parsing crafted or malformed .nettrace data then triggers an uncatchable StackOverflowException that terminates the process. The fix rejects negative and oversized lengths before allocating.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses the library to read untrusted or externally supplied EventPipe (.nettrace) trace data.
Background info
Microsoft.Diagnostics.Tracing.TraceEvent is vulnerable to Denial of Service (DoS) in versions 3.1.21 - 3.2.5.
How to fix this
Upgrade the Microsoft.Diagnostics.Tracing.TraceEvent library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant