Is CVE-2026-118750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118750 being exploited in the wild.

How severe is CVE-2026-118750?

High severity, with a CVSS score of 7.5, published 10 November 2026.

Which products and versions are affected?

Microsoft.AspNetCore.WebUtilities (NuGet) >= 2.3.0, <= 2.3.13, ECOSYSTEM:introduced=2.3.0,fixed=2.3.14.

Is there a fix for CVE-2026-118750?

Yes. Microsoft.AspNetCore.WebUtilities (NuGet): upgrade to 2.3.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118750 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118750?

Check whether you run Microsoft Asp.Net Core or Microsoft.AspNetCore.WebUtilities (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118750: Microsoft ASP.NET Core denial of service via resource allocation

Q: Is there a fix for CVE-2026-118750?

Yes. Microsoft.AspNetCore.WebUtilities (NuGet): upgrade to 2.3.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118750 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118750?

Check whether you run Microsoft Asp.Net Core or Microsoft.AspNetCore.WebUtilities (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118750 · Severity: high · CVSS 7.5 · Published 2026-11-10

ASP.NET Core, a framework used to build web applications and services, contains a flaw that allows attackers to send specially crafted requests without authentication, causing the application to allocate resources uncontrollably. This can exhaust server resources and make the application unavailable to legitimate users, resulting in service outages.

Technologies: Microsoft Asp.Net Core. Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-118750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118750 being exploited in the wild.
How severe is CVE-2026-118750?: High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?: Microsoft.AspNetCore.WebUtilities (NuGet) >= 2.3.0, <= 2.3.13, ECOSYSTEM:introduced=2.3.0,fixed=2.3.14.
Is there a fix for CVE-2026-118750?: Yes. Microsoft.AspNetCore.WebUtilities (NuGet): upgrade to 2.3.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118750 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118750?: Check whether you run Microsoft Asp.Net Core or Microsoft.AspNetCore.WebUtilities (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.AspNetCore.WebUtilities (NuGet): upgrade to 2.3.14 or later

dotnet add package Microsoft.AspNetCore.WebUtilities --version 2.3.14

Technical details

The vulnerability is an improper resource allocation without limits or throttling in ASP.NET Core. An unauthenticated attacker on the network can trigger uncontrolled resource consumption, leading to denial of service. The flaw can be exploited remotely without user interaction or prior authentication.

Affected products

Microsoft ASP.NET Core

Identifiers

CVE-2026-118750
GHSA-6527-9fp8-r4x6

Timeline

2026-11-10: disclosed

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118750

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.