Executive brief
ASP.NET Core's IIS Integration module handles incoming web requests from IIS servers. The module does not properly validate highly compressed data, allowing an unauthenticated attacker to send specially crafted requests that consume excessive server resources and cause a denial of service. The vulnerability can be exploited over the network without requiring any special privileges or user interaction.
Technical details
The vulnerability is a data amplification issue (CWE-409) in the Microsoft.AspNetCore.Server.IISIntegration NuGet package. The module fails to properly handle highly compressed incoming data, allowing an attacker to send small compressed payloads that expand to consume excessive memory or CPU resources upon decompression, triggering a denial of service. The attack requires network access but no authentication or user interaction. Affected versions include ASP.NET Core 8.0.0–8.0.30, 9.0.0–9.0.19, 10.0.0–10.0.11, and 11.0.0-preview.1 through 11.0.0-rc.0. Patches are available in versions 8.0.31, 9.0.20, 10.0.12, and 11.0.0-rc.1 and later.
Affected products
- Microsoft ASP.NET Core 8.0.0 through 8.0.30; 9.0.0 through 9.0.19; 10.0.0 through 10.0.11; 11.0.0-preview.1 through 11.0.0-rc.0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released: 8.0.31, 9.0.20, 10.0.12, 11.0.0-rc.1