Is CVE-2026-114149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114149 being exploited in the wild.

How severe is CVE-2026-114149?

High severity, with a CVSS score of 7.5, published 10 November 2026.

Which products and versions are affected?

Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0-preview.1.23112.2, = 8.0.0-preview.1.23112.2, = 8.0.0-preview.1.23112.2, = 8.0.0-preview.1.23112.2, <= 8.0.33, ECOSYSTEM:introduced=8.0.0-preview.1.23112.2,fixed=8.0.34; and 8 more.

How is CVE-2026-114149 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114149?

Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114149: Microsoft ASP.NET Core denial of service via resource consumption

Q: Is there a fix for CVE-2026-114149?

Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.WebUtilities (NuGet): upgrade to 8.0.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114149 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114149?

Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114149 · Severity: high · CVSS 7.5 · Published 2026-11-10

ASP.NET Core is a framework used to build web applications. An attacker can cause excessive resource consumption on servers running vulnerable ASP.NET Core applications over the network, making those applications unavailable to legitimate users. This could disrupt critical business services and require manual intervention to restore.

Quick answers

Is CVE-2026-114149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114149 being exploited in the wild.
How severe is CVE-2026-114149?: High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?: Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0-preview.1.23112.2, <= 8.0.33, ECOSYSTEM:introduced=8.0.0-preview.1.23112.2,fixed=8.0.34; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) >= 8.0.0-preview.1.23112.2, <= 8.0.33, ECOSYSTEM:introduced=8.0.0-preview.1.23112.2,fixed=8.0.34; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) >= 8.0.0-preview.1.23112.2, <= 8.0.33, ECOSYSTEM:introduced=8.0.0-preview.1.23112.2,fixed=8.0.34; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) >= 8.0.0-preview.1.23112.2, <= 8.0.33, ECOSYSTEM:introduced=8.0.0-preview.1.23112.2,fixed=8.0.34; and 8 more.
Is there a fix for CVE-2026-114149?: Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.34 or later; Microsoft.AspNetCore.WebUtilities (NuGet): upgrade to 8.0.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114149 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114149?: Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.34

Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 8.0.34

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 8.0.34

Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 8.0.34

Microsoft.AspNetCore.WebUtilities (NuGet): upgrade to 8.0.34 or later

dotnet add package Microsoft.AspNetCore.WebUtilities --version 8.0.34

Technical details

The vulnerability is an uncontrolled resource consumption flaw in ASP.NET Core that allows an unauthorized attacker to trigger a denial of service condition via network requests. No authentication is required to exploit this issue. The vulnerability results in application unavailability until the affected process is restarted or resources are freed.

Affected products

Microsoft ASP.NET Core

Identifiers

CVE-2026-114149
GHSA-x33c-w48q-qrgc

Timeline

2026-11-10: disclosed

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114149

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.