CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation

Quick answers

Is CVE-2026-26130 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26130 being exploited in the wild.

How severe is CVE-2026-26130?

High severity, with a CVSS score of 7.5, published 10 March 2026.

Which products and versions are affected?

Microsoft Asp.Net Core 8.0, 9.0; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.25; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.25; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.25; and 9 more.

Is there a fix for CVE-2026-26130?

Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26130 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26130?

Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 8.0.25

• Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.25 or later

  dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 8.0.25

Technical details

A denial-of-service (DoS) vulnerability exists in ASP.NET Core due to uncontrolled resource allocation (CWE-770). An unauthenticated remote attacker can exploit this by sending malicious requests over the network that trigger excessive consumption of system resources, such as memory or CPU, without proper throttling or limits. This leads to a denial-of-service condition for the affected application. The vulnerability impacts .NET 8.0 and .NET 9.0 environments. Security updates have been released by Microsoft and Red Hat (e.g., .NET SDK 8.0.125/9.0.115 and Runtime 8.0.25/9.0.14) to address the issue.

Affected products

• Microsoft ASP.NET Core 8.0, 9.0
• Red Hat .NET 8.0, 9.0, 10.0

Identifiers

• CVE-2026-26130
• GHSA-4vgm-c2wm-63mw

Timeline

• 2026-03-10: disclosed: CVE published
• 2026-04-23: patched: Red Hat released security advisories and updated packages

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130
• https://access.redhat.com/errata/RHSA-2026:10082
• https://access.redhat.com/errata/RHSA-2026:10083
• https://access.redhat.com/errata/RHSA-2026:10084
• https://access.redhat.com/errata/RHSA-2026:10085
• https://access.redhat.com/errata/RHSA-2026:10091
• https://access.redhat.com/errata/RHSA-2026:4443