Junglewise Threat Intelligence

CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation

CVE-2026-26130 · Severity: high · CVSS 7.5 · Published 2026-03-10

Executive brief

A vulnerability in ASP.NET Core, a popular framework for building web applications and services, could allow an attacker to crash or slow down a website. By sending specifically crafted requests that consume excessive system resources, an unauthorized user can cause a denial-of-service (DoS) condition. This impact prevents legitimate users from accessing the application, potentially disrupting business operations and customer services.

Technical details

A denial-of-service (DoS) vulnerability exists in ASP.NET Core due to uncontrolled resource allocation (CWE-770). An unauthenticated remote attacker can exploit this by sending malicious requests over the network that trigger excessive consumption of system resources, such as memory or CPU, without proper throttling or limits. This leads to a denial-of-service condition for the affected application. The vulnerability impacts .NET 8.0 and .NET 9.0 environments. Security updates have been released by Microsoft and Red Hat (e.g., .NET SDK 8.0.125/9.0.115 and Runtime 8.0.25/9.0.14) to address the issue.

Affected products

  • Microsoft ASP.NET Core 8.0, 9.0
  • Red Hat .NET 8.0, 9.0, 10.0

Timeline

  • 2026-03-10: disclosed: CVE published
  • 2026-04-23: patched: Red Hat released security advisories and updated packages

References

Related threats