Is CVE-2026-70196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70196 being exploited in the wild.

How severe is CVE-2026-70196?

Medium severity, with a CVSS score of 5.9, published 13 October 2026.

Which products and versions are affected?

Microsoft Asp.Net Core 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0, = 8.0.0, = 8.0.0, <= 8.0.31; and 9 more.

Is there a fix for CVE-2026-70196?

Yes: fixed in ASP.NET Core 8.0.32, 9.0.21, 10.0.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70196 attacked?

It is attacked over the network.

Am I affected by CVE-2026-70196?

Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70196: ASP.NET Core denial of service in FormPipeReader

Q: Is there a fix for CVE-2026-70196?

Yes: fixed in ASP.NET Core 8.0.32, 9.0.21, 10.0.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-70196 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-70196?

Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70196 · Severity: medium · CVSS 5.9 · Published 2026-10-13

Microsoft.AspNetCore.WebUtilities in ASP.NET Core handles form data uploads for web applications. A flaw in FormPipeReader causes it to repeatedly rescan buffered form data, consuming excessive CPU resources and making the application unresponsive. An attacker can send specially crafted form submissions to trigger this condition and disable the web service.

Quick answers

Is CVE-2026-70196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70196 being exploited in the wild.
How severe is CVE-2026-70196?: Medium severity, with a CVSS score of 5.9, published 13 October 2026.
Which products and versions are affected?: Microsoft Asp.Net Core 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) >= 8.0.0, <= 8.0.31; and 9 more.
Is there a fix for CVE-2026-70196?: Yes: fixed in ASP.NET Core 8.0.32, 9.0.21, 10.0.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70196 attacked?: It is attacked over the network.
Am I affected by CVE-2026-70196?: Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ASP.NET Core 8.0.32, 9.0.21, 10.0.13

Technical details

The vulnerability is an inefficient algorithmic complexity issue (CWE-407) in FormPipeReader that exhibits quadratic CPU consumption when processing incrementally arriving form data. The attack requires only network access with no authentication or user interaction. A remote attacker can send crafted multipart form requests to exhaust server CPU and cause denial of service.

Affected products

Microsoft ASP.NET Core 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12

Identifiers

CVE-2026-70196
GHSA-57xr-hfxx-jw5x

Timeline

2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.