What is the CVSS score of CVE-2026-26130?

CVE-2026-26130 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.3%.

How to fix or mitigate CVE-2026-26130?

Within 24 hours: Inventory all ASP.NET Core instances and assess which are internet-facing or handle critical services. Within 7 days: Apply available vendor patches to all affected ASP.NET Core systems, prioritizing production environments. Within 30 days: Complete patching across all environments including development and staging, and validate through testing.

Asp Net Core CVE-2026-26130

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-10 secure@microsoft.com

GHSA-4vgm-c2wm-63mw

Denial Of Service Microsoft Asp Net Core

7.5

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send numerous unbounded resource allocation requests
Exploit

ASP.NET Core fails to throttle requests
Execution

Service exhaustion occurs
Impact

Application becomes unavailable

Vulnerability Assessment

Weakness	CWE CWE-770 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource allocation limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against default ASP.NET Core configurations without resource throttling or request rate-limiting enabled.
Impact	CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. Exploitable via remote/network.
Exploit ScenarioDerived	A remote attacker without authentication could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 1.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Uncontrolled resource allocation in ASP.NET Core enables unauthenticated remote attackers to exhaust system resources and cause denial of service without requiring user interaction. The vulnerability affects .NET applications exposed to network access, allowing attackers to trigger unbounded resource consumption from any network location. A patch is available to address this issue.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 7.5

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

Affected Packages

microsoft asp_net_core_10_0_10_0_4 fix: ASP.NET Core 10.0 10.0.4

microsoft asp_net_core_8_0_8_0_25 fix: ASP.NET Core 8.0 8.0.25

microsoft asp_net_core_9_0_9_0_14 fix: ASP.NET Core 9.0 9.0.14

nuget microsoft.aspnetcore.app.runtime.linux-arm fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.linux-arm64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.linux-musl-arm fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.linux-musl-arm64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.linux-musl-x64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.linux-x64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.osx-arm64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.osx-x64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.win-arm fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.win-arm64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.win-x64 fix: 8.0.25, 9.0.14, 10.0.4

nuget microsoft.aspnetcore.app.runtime.win-x86 fix: 8.0.25, 9.0.14, 10.0.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 15 packages in microsoft, nuget

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Know when Asp Net Core gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 13:58 nvd

Patch available

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.5

DescriptionCVE.org

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Executive ViewAI

Why It Matters

ASP.NET Core applications are vulnerable to denial-of-service attacks where attackers can exhaust server resources without limits, causing service unavailability. Any organization running ASP.NET Core in production faces potential business disruption and customer impact until patched.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not possible, implement network-level rate limiting and request throttling via WAF or load balancer, restrict API endpoints to known IP ranges, and enable resource quotas and connection limits at the application level.

Threat Intelligence Overview

EPSS Score

1.3%

Top 21% exploitable

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 1.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*

More in Asp Net Core

View all

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2023-38180 HIGH Act Now

7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e

CVE-2025-26682 HIGH Act Now

7.5 Apr 08

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove

CVE-2025-55315 CRITICAL Act Now POC

9.9

ASP.NET Core Kestrel request smuggling allows a low-privileged network attacker (PR:L, no user interaction) to desynchro

CVE-2026-69304 MEDIUM This Month POC

5.9 Sep 08

Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and den

CVE-2017-11879 HIGH This Week

8.8 Nov 15

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a s

CVE-2026-88092 CRITICAL Act Now

9.4 Oct 13

Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP r

CVE-2026-96230 HIGH This Week

8.8 Oct 13

Cross-site scripting (CWE-79) in the ASP.NET Core Blazor WebAssembly Server hosting component allows an unauthenticated,

CVE-2026-70175 HIGH This Week

8.1 Oct 13

Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and e

CVE-2017-8700 HIGH This Week

7.5 Nov 15

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retri

CVE-2026-45591 HIGH This Week

7.5 Jun 09

Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disru

CVE-2021-43877 HIGH This Week

8.8 Dec 15

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2024-28182 MEDIUM

5.3

CVE-2023-2650 MEDIUM

6.5

CVE-2017-5850 HIGH POC

7.5

CVE-2022-32206 MEDIUM POC

6.5

CVE-2023-24998 HIGH

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Liberty Linux 8	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back