# CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation

Source: https://junglewise.ai/threats/cve-2026-26130-microsoft-asp-net-core-denial-of-service-via-uncontrolled  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-26130 · Severity: high · CVSS 7.5 · Published 2026-03-10

A vulnerability in ASP.NET Core, a popular framework for building web applications and services, could allow an attacker to crash or slow down a website. By sending specifically crafted requests that consume excessive system resources, an unauthorized user can cause a denial-of-service (DoS) condition. This impact prevents legitimate users from accessing the application, potentially disrupting business operations and customer services.

Technologies: [Microsoft Asp.Net Core](https://junglewise.ai/threats/technologies/asp-net-core), [Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-arm), [Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-arm64), [Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-arm), [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-arm64), [Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-x64), [Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-x64), [Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-osx-arm64), [Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-osx-x64), [Microsoft.AspNetCore.App.Runtime.win-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-arm), [Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-arm64), [Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-x64), [Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-x86). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-26130 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26130 being exploited in the wild.

**How severe is CVE-2026-26130?** High severity, with a CVSS score of 7.5, published 10 March 2026.

**Which products and versions are affected?** Microsoft Asp.Net Core 8.0, 9.0; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.25; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.25; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.25; and 9 more.

**Is there a fix for CVE-2026-26130?** Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.25 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26130 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26130?** Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 8.0.25
  ```

- Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.25 or later

  ```sh
  dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 8.0.25
  ```


## Technical details

A denial-of-service (DoS) vulnerability exists in ASP.NET Core due to uncontrolled resource allocation (CWE-770). An unauthenticated remote attacker can exploit this by sending malicious requests over the network that trigger excessive consumption of system resources, such as memory or CPU, without proper throttling or limits. This leads to a denial-of-service condition for the affected application. The vulnerability impacts .NET 8.0 and .NET 9.0 environments. Security updates have been released by Microsoft and Red Hat (e.g., .NET SDK 8.0.125/9.0.115 and Runtime 8.0.25/9.0.14) to address the issue.

## Affected products

- Microsoft ASP.NET Core 8.0, 9.0
- Red Hat .NET 8.0, 9.0, 10.0

## Identifiers

- CVE-2026-26130
- GHSA-4vgm-c2wm-63mw

## Timeline

- 2026-03-10: disclosed: CVE published
- 2026-04-23: patched: Red Hat released security advisories and updated packages

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130)
- [https://access.redhat.com/errata/RHSA-2026:10082](https://access.redhat.com/errata/RHSA-2026:10082)
- [https://access.redhat.com/errata/RHSA-2026:10083](https://access.redhat.com/errata/RHSA-2026:10083)
- [https://access.redhat.com/errata/RHSA-2026:10084](https://access.redhat.com/errata/RHSA-2026:10084)
- [https://access.redhat.com/errata/RHSA-2026:10085](https://access.redhat.com/errata/RHSA-2026:10085)
- [https://access.redhat.com/errata/RHSA-2026:10091](https://access.redhat.com/errata/RHSA-2026:10091)
- [https://access.redhat.com/errata/RHSA-2026:4443](https://access.redhat.com/errata/RHSA-2026:4443)

## Related threats

- [Microsoft ASP.NET Core race condition privilege escalation](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-security-04275796)
- [Microsoft ASP.NET Core denial of service via resource consumption](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-denial-of-0f1476a7)
- [ASP.NET Core security feature bypass via input validation](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-security-942d98c7)
- [ASP.NET Core inefficient algorithmic complexity denial of service](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-denial-of-f3e14a11)
- [Microsoft ASP.NET Core denial of service via resource allocation](https://junglewise.ai/threats/cve-2026-118750-allocation-of-resources-without-limits-or-throttling-in-asp-net)