Executive brief
A vulnerability in Microsoft ASP.NET Core OData libraries allows an unauthenticated attacker to crash or slow down a web application by overwhelming its resources. This component is commonly used to build data-driven web APIs. An exploit could lead to a sustained service outage, preventing legitimate users from accessing the application or its data.
Technical details
A denial-of-service vulnerability exists in Microsoft AspNet.OData and AspNetCore.OData due to improper resource management (CWE-770). The flaw stems from the allocation of resources without sufficient limits or throttling during the processing of OData requests. A remote, unauthenticated attacker can exploit this by sending specially crafted network requests that consume excessive system resources, leading to a denial-of-service condition. The vulnerability is addressed in AspNet.OData version 7.8.0 and AspNetCore.OData version 9.5.0.
Affected products
- Microsoft AspNet.OData 7.0.0 to 7.7.x (fixed in 7.8.0)
- Microsoft AspNetCore.OData 9.0.0 to 9.4.x (fixed in 9.5.0)
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory