CVE-2026-109478: ASP.NET Core Denial of Service Vulnerability
ASP.NET Core Denial of Service Vulnerability
Other sources
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.45 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.34Patch KB5135243 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.12.0
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates that exploitation can be performed remotely without privileges or user interaction.
How complex is exploitation expected to be?
The CVSS vector rates attack complexity as low, indicating no specialized preconditions are identified in the available data.