GHSA-wrm2-c2h2-4w82: Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability

Q: Should this advisory be tracked as a separate vulnerability record?

No. This advisory was withdrawn as a duplicate of GHSA-r3qf-p3jm-8h4p and is retained only to preserve external references. Track the duplicate advisory for the authoritative record.

Q: Can this issue be exploited without authentication or user interaction?

The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. The original description states that an unauthorized attacker can cause denial of service over a network.

Q: What is the expected security impact?

The stated impact is denial of service through inefficient algorithmic complexity in ASP.NET Core. The severity vector indicates high availability impact and no stated confidentiality or integrity impact.

Published Nov 10, 2026

Updated

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r3qf-p3jm-8h4p. This link is maintained to preserve external references.

Original Description Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected Software

1 affected component

nuget/microsoft.aspnetcore.app.runtime.linux-arm>=8.0.0-preview.1.23112.2<=8.0.33

Event History

Nov 10, 2026

Advisory Published

via GitHub·09:32 PM

Data Sourced

via GitHub·09:32 PM

DescriptionSeverityWeaknessAffected Software

Nov 11, 2026

Withdrawn

via GitHub·12:21 AM

Frequently Asked Questions

Should this advisory be tracked as a separate vulnerability record?

No. This advisory was withdrawn as a duplicate of GHSA-r3qf-p3jm-8h4p and is retained only to preserve external references. Track the duplicate advisory for the authoritative record.

Can this issue be exploited without authentication or user interaction?

The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. The original description states that an unauthorized attacker can cause denial of service over a network.

What is the expected security impact?

The stated impact is denial of service through inefficient algorithmic complexity in ASP.NET Core. The severity vector indicates high availability impact and no stated confidentiality or integrity impact.

GHSA-wrm2-c2h2-4w82: Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability

Affected Software

Event History

Frequently Asked Questions

Should this advisory be tracked as a separate vulnerability record?

Can this issue be exploited without authentication or user interaction?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Should this advisory be tracked as a separate vulnerability record?

Can this issue be exploited without authentication or user interaction?

What is the expected security impact?