CVE-2026-109468: ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Other sources
ASP.NET Core Denial of Service Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthorized attacker can exploit it remotely over a network. No privileges or user interaction are required.
What is the practical impact?
Successful exploitation can cause a denial of service by triggering unbounded or insufficiently throttled resource allocation. The provided assessment indicates availability impact only; no confidentiality or integrity impact is identified.
Which listed software should be reviewed?
Review deployments and development environments using Microsoft System.Formats.Cbor, Microsoft Visual Studio 2026, or Microsoft Visual Studio 2022, particularly where affected ASP.NET Core components are reachable over the network.