# CVE-2026-70196: ASP.NET Core denial of service in FormPipeReader

Source: https://junglewise.ai/threats/cve-2026-70196-microsoft-security-advisory-asp-net-core-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-13  
License: CC BY 4.0 with a link back

CVE-2026-70196 · Severity: medium · CVSS 5.9 · Published 2026-10-13

Microsoft.AspNetCore.WebUtilities in ASP.NET Core handles form data uploads for web applications. A flaw in FormPipeReader causes it to repeatedly rescan buffered form data, consuming excessive CPU resources and making the application unresponsive. An attacker can send specially crafted form submissions to trigger this condition and disable the web service.

Technologies: [Microsoft Asp.Net Core](https://junglewise.ai/threats/technologies/asp-net-core), [Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-arm), [Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-arm64), [Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-arm), [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-arm64), [Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-musl-x64), [Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-linux-x64), [Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-osx-arm64), [Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-osx-x64), [Microsoft.AspNetCore.App.Runtime.win-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-arm), [Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-arm64), [Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-x64), [Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-x86). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-70196 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70196 being exploited in the wild.

**How severe is CVE-2026-70196?** Medium severity, with a CVSS score of 5.9, published 13 October 2026.

**Which products and versions are affected?** Microsoft Asp.Net Core 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) >= 8.0.0, <= 8.0.31; and 9 more.

**Is there a fix for CVE-2026-70196?** Yes: fixed in ASP.NET Core 8.0.32, 9.0.21, 10.0.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70196 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-70196?** Check whether you run Microsoft Asp.Net Core, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ASP.NET Core 8.0.32, 9.0.21, 10.0.13

## Technical details

The vulnerability is an inefficient algorithmic complexity issue (CWE-407) in FormPipeReader that exhibits quadratic CPU consumption when processing incrementally arriving form data. The attack requires only network access with no authentication or user interaction. A remote attacker can send crafted multipart form requests to exhaust server CPU and cause denial of service.

## Affected products

- Microsoft ASP.NET Core 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12

## Identifiers

- CVE-2026-70196
- GHSA-57xr-hfxx-jw5x

## Timeline

- 2026-10-13: disclosed

## Related threats

- [Microsoft ASP.NET Core resource exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109468-allocation-of-resources-without-limits-or-throttling-in-asp-net)
- [ASP.NET Core Kestrel denial of service in HTTP/3 handling](https://junglewise.ai/threats/cve-2026-70186-microsoft-security-advisory-asp-net-core-denial-of-service)
- [Microsoft ASP.NET Core Kestrel HTTP request smuggling in HTTP/2](https://junglewise.ai/threats/cve-2026-70188-microsoft-security-advisory-asp-net-core-security-feature-bypass)
- [Microsoft ASP.NET Core Localization denial of service](https://junglewise.ai/threats/cve-2026-96236-microsoft-security-advisory-asp-net-core-denial-of-service)
- [Microsoft ASP.NET Core authorization bypass in Blazor AuthorizeRouteView](https://junglewise.ai/threats/cve-2026-70183-microsoft-security-advisory-asp-net-core-security-feature-bypass)