Executive brief
ASP.NET Core's IIS middleware component, which handles request processing for web applications, contains a flaw in how it decompresses incoming requests. An attacker can exploit this by sending specially crafted compressed requests that consume excessive memory when decompressed, causing the web application to become unavailable. This impacts any organization running ASP.NET Core applications on Windows IIS servers.
Technical details
This vulnerability is a data amplification attack (CWE-409) in the ASP.NET Core IIS integration layer. The IIS Middleware failed to enforce limits on decompression ratios, allowing an attacker to send requests with extreme compression ratios (highly compressed data that expands dramatically). When decompressed, these requests consume excessive memory, leading to memory exhaustion and denial of service. The vulnerability is reachable over the network without authentication or user interaction (CVSS AV:N, PR:N, UI:N), though it has high attack complexity (AC:H). Patches are available for all affected .NET versions: 8.0.31, 9.0.20, 10.0.12, and 11.0.0-rc.1. Applications must be recompiled and redeployed if self-contained.
Affected products
- Microsoft ASP.NET Core 8.0.0–8.0.30, 9.0.0–9.0.19, 10.0.0–10.0.11, 11.0.0-preview.1–11.0.0-rc.1 (Microsoft.AspNetCore.Server.IISIntegration and related runtime packages)
Timeline
- 2026-09-08: disclosed
- 2026-09-09: advisory
- 2026-09-08: patched: Patch versions released: 8.0.31, 9.0.20, 10.0.12, 11.0.0-rc.1