CVE-2026-114147: ASP.NET Core Denial of Service Vulnerability
ASP.NET Core Denial of Service Vulnerability
Other sources
Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.15Patch KB5135241 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.23Patch KB5135242 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.12.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.45 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.34Patch KB5135243 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.15
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker can exploit the vulnerability remotely over a network without authentication or user interaction.
What is the expected impact of successful exploitation?
Successful exploitation can deny service by causing memory not to be released after its effective lifetime. The provided impact information indicates availability impact, with no stated confidentiality or integrity impact.
Which products are identified as affected?
The affected software list includes Microsoft .NET, Microsoft.AspNetCore.SignalR.StackExchangeRedis, Microsoft Visual Studio 2026, and Microsoft Visual Studio 2022.