Vulnerabilities
CVE-2026-70181: ASP.NET Core Denial of Service Vulnerability – Update Required
Microsoft has issued a security update for ASP.NET Core to address CVE-2026-70181, a denial‑of‑service flaw that can be triggered by malformed HTTP requests. The fix is included in the latest ASP.NET Core runtime and SDK releases; defenders should apply the update immediately and monitor traffic for suspicious request patterns.
What happened
A malformed HTTP request can cause ASP.NET Core to consume excessive CPU and memory, leading to a denial‑of‑service condition. The flaw is triggered by a specific request pattern that bypasses normal request validation.
Impact
Any application built on ASP.NET Core that processes untrusted traffic is at risk. The vulnerability can be exploited remotely without authentication and can bring the target service to a halt.
Affected Versions
- ASP.NET Core 6.0.x (all minor releases)
- ASP.NET Core 7.0.x (all minor releases)
- ASP.NET Core 8.0.x (all minor releases)
Mitigation
- Apply the latest ASP.NET Core runtime and SDK updates (see KB article 0000000).
- Update Visual Studio to the latest version; the update includes the same security fix.
- Deploy application firewall rules to rate‑limit or block suspicious request patterns.
- Verify that the application’s request handling pipeline is not exposed to untrusted networks.
Monitoring & Response
Watch for spikes in CPU usage or memory consumption, and inspect logs for repeated malformed request signatures. If an attack is detected, isolate the affected service and apply the patch before restoring connectivity.
Related vulnerabilities
CVE-2026-70186: ASP.NET Core Denial‑of‑Service Fixes Released
Microsoft has addressed a denial‑of‑service vulnerability in ASP.NET Core (CVE‑2026‑70186). The fix is included in the latest security updates, and the update table now links to the download and KB article for Visual Studio. Defenders should verify that ASP.NET Core is patched and that Visual Studio is updated.
Read briefing
CVE-2026-96233: ASP.NET Core Denial‑of‑Service Vulnerability Fixed in Latest .NET Builds
A flaw in ASP.NET Core allows attackers to trigger a denial‑of‑service via crafted HTTP requests. Microsoft has released patches for .NET 6.0 through 11.0; the fix is already in the latest builds. Defenders should verify and apply the updates and monitor for abnormal resource usage.
Read briefing
CVE-2026-70179: ASP.NET Core Elevation of Privilege – Informational Update
Microsoft has released an informational update for CVE-2026-70179, an elevation of privilege flaw in ASP.NET Core. The update adds download and KB article links for Visual Studio, but the fixed builds remain unchanged. Defenders should verify that their ASP.NET Core deployments are on patched versions and review the updated documentation.
Read briefing
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing