Is CVE-2026-70181 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70181 being exploited in the wild.

How severe is CVE-2026-70181?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Microsoft Asp.Net Core 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12; Microsoft.AspNetCore.App.Runtime 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 9.0.0, = 9.0.0, <= 9.0.20, ECOSYSTEM:introduced=9.0.0,fixed=9.0.21; and 10 more.

How is CVE-2026-70181 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70181?

Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70181: Microsoft ASP.NET Core denial of service in multipart processing

Q: Is there a fix for CVE-2026-70181?

Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 9.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-70181 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-70181?

Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70181 · Severity: high · CVSS 7.5 · Published 2026-10-13

ASP.NET Core, which powers web applications, contains a vulnerability in its multipart form data processing that allows an attacker to exhaust server memory and cause a denial of service. An unauthenticated attacker can send specially crafted requests to crash or become unresponsive applications that accept file uploads or multipart data.

Quick answers

Is CVE-2026-70181 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70181 being exploited in the wild.
How severe is CVE-2026-70181?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Microsoft Asp.Net Core 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12; Microsoft.AspNetCore.App.Runtime 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 9.0.0, <= 9.0.20, ECOSYSTEM:introduced=9.0.0,fixed=9.0.21; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) >= 9.0.0, <= 9.0.20, ECOSYSTEM:introduced=9.0.0,fixed=9.0.21; and 10 more.
Is there a fix for CVE-2026-70181?: Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 9.0.21 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 9.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70181 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70181?: Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 9.0.21

Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 9.0.21

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm --version 9.0.21

Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 9.0.21

Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 9.0.21 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 9.0.21

Technical details

The FileBufferingReadStream component in Microsoft.AspNetCore.WebUtilities eagerly allocates memory buffers during multipart form processing without enforcing resource limits, leading to memory exhaustion. An unauthenticated network attacker can trigger this by sending a crafted multipart request, causing the application to consume unbounded memory and become unavailable. The vulnerability affects .NET 8, 9, and 10.

Affected products

Microsoft ASP.NET Core 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12
Microsoft Microsoft.AspNetCore.App.Runtime 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12

Identifiers

CVE-2026-70181
GHSA-w5qq-qrpp-rf4c

Timeline

2026-10-13: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.