Vulnerabilities
CVE-2026-96233: ASP.NET Core Denial‑of‑Service Vulnerability Fixed in Latest .NET Builds
A flaw in ASP.NET Core allows attackers to trigger a denial‑of‑service via crafted HTTP requests. Microsoft has released patches for .NET 6.0 through 11.0; the fix is already in the latest builds. Defenders should verify and apply the updates and monitor for abnormal resource usage.
What Happened
A flaw in ASP.NET Core allows an attacker to trigger a denial‑of‑service by sending specially crafted HTTP requests that cause the framework to consume excessive resources. The issue is identified as CVE‑2026‑96233.
The Security Updates table was updated to add KB article links for .NET 11.0. This is an informational change; the fixed builds are unchanged.
Impact
All ASP.NET Core applications running on .NET 6.0 through 11.0 are potentially affected. The vulnerability can lead to service interruption but does not provide code execution or data exfiltration.
Mitigation
- Verify that your applications are built against the latest .NET 6.0, 7.0, 8.0, 9.0, 10.0, or 11.0 releases that include the fix.
- Apply the corresponding security update (KB… for each version) as listed in the Microsoft Security Updates table.
- Restart affected services after patching to ensure the new binaries are loaded.
- Consider implementing rate‑limiting or request throttling as an additional safeguard.
Monitoring
Watch for abnormal CPU or memory spikes and repeated 503 responses in your application logs. Configure alerts for sustained high resource usage that could indicate an ongoing DoS attempt.
Related vulnerabilities
CVE-2026-70179: ASP.NET Core Elevation of Privilege – Informational Update
Microsoft has released an informational update for CVE-2026-70179, an elevation of privilege flaw in ASP.NET Core. The update adds download and KB article links for Visual Studio, but the fixed builds remain unchanged. Defenders should verify that their ASP.NET Core deployments are on patched versions and review the updated documentation.
Read briefing
CVE-2026-96236: ASP.NET Core Denial of Service – No New Fix Required
Microsoft updated its Security Updates table to add KB article links for ASP.NET Core 11.0 and Visual Studio, but the vulnerability remains fixed in the same builds. Defenders should confirm they are running a patched version and review the KB for details.
Read briefing
.NET 11.0 Denial of Service Vulnerability CVE-2026-84008 – No New Fix, KB Links Added
Microsoft has released an informational update for CVE-2026-84008, a denial‑of‑service flaw in .NET 11.0. The update adds KB article links for .NET 11.0 and Visual Studio but does not change the fixed builds. Defenders should verify that they are running the latest patched .NET 11.0 runtime and update Visual Studio accordingly.
Read briefing
CVE-2026-96957 .NET Security Feature Bypass – Informational Update
Microsoft updated the Security Updates table with KB links for .NET 11.0 and Visual Studio, clarifying that the fixed builds remain unchanged. Defenders should confirm they run the latest patched .NET version and keep Visual Studio updated.
Read briefing