Executive brief
A vulnerability in Microsoft ASP.NET Core OData libraries could allow an attacker to crash or slow down web applications by overwhelming them with resource-intensive requests. This is a denial-of-service issue that affects the availability of web services built on these frameworks. An attacker does not need a password or special access to trigger this condition, potentially leading to service outages for customers.
Technical details
A denial-of-service (DoS) vulnerability exists in Microsoft AspNet.OData and AspNetCore.OData due to improper resource management (CWE-770). The flaw stems from the allocation of resources without sufficient limits or throttling when processing OData requests. A remote, unauthenticated attacker can exploit this by sending specially crafted network requests that consume excessive system resources, leading to service exhaustion. The vulnerability is addressed in AspNet.OData version 7.8.0 and AspNetCore.OData version 9.5.0.
Affected products
- Microsoft AspNet.OData 7.0.0 to 7.7.x (less than 7.8.0)
- Microsoft AspNetCore.OData 9.0.0 to 9.4.x (less than 9.5.0)
Timeline
- 2026-07-14: advisory: Initial publication by Microsoft and NVD