rootpwn

high · CVSS v3 7.5

CVE-2026-109468

ASP.NET Core applications are vulnerable to resource exhaustion due to unlimited allocation, enabling attackers to cause denial of service.

Overview

ASP.NET Core applications are vulnerable to resource exhaustion due to unlimited allocation, enabling attackers to cause denial of service. The flaw allows unauthenticated network-based attacks that can overwhelm server resources. It impacts availability for all ASP.NET Core deployments.

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Impact

The vulnerability compromises Availability, potentially leading to service outages. Defenders must protect application uptime and prevent resource starvation. Attackers can disrupt legitimate users and degrade overall system performance.

Remediation

Apply the latest Microsoft security updates for ASP.NET Core and .NET runtime. Configure request throttling, set maximum concurrent connections, and enable application-level rate limiting. Monitor CPU/memory usage and deploy WAF or Azure Front Door to mitigate excessive requests.

Risk context

Severity is high with a CVSS v3 score of 7.5. No EPSS data is available, but the lack of throttling makes the risk immediate for exposed services.

Affected products

  • Microsoft ASP.NET Core
  • Microsoft .NET 6
  • Microsoft .NET 7
  • Microsoft .NET 8

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

denial-of-service aspnet-core resource-allocation high-severity availability throttling patch

← All CVEs

Related CVEs

high

CVE-2026-96537

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

View analysis

high

CVE-2026-102986

Plane, an open-source project management tool, has a flaw in its public asset endpoint that allows authenticated users to create or delete assets in any project if they know the anchor. This can lead to unauthorized file injection, storage abuse, and data loss across workspaces. The vulnerability is present in versions 1.3.1 and earlier.

View analysis

high

CVE-2026-97370

CVE-2026-97370 affects the open‑source Junrar Java library, allowing a crafted RAR4 archive to trigger an infinite CPU loop during extraction. The flaw resides in the RarVM.ExecuteCode routine, which can jump beyond the program’s code size without proper bounds checking. This results in a denial‑of‑service condition that can exhaust worker threads and degrade service availability.

View analysis

high

CVE-2026-108448

A heap-based buffer overflow in Microsoft Outlook can be triggered by an attacker over the network, enabling remote code execution. The flaw exists in the handling of certain message types or attachments. It allows attackers to run arbitrary code on the victim's machine without authentication.

View analysis