What is the CVSS score of CVE-2026-45591?

CVE-2026-45591 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.7%.

Which versions of ASP.NET Core are affected by CVE-2026-45591?

Organizations operating ASP.NET Core applications face immediate service disruption risk from a critical availability vulnerability requiring unauthenticated network access and no user interaction to…. A patch is available.

How to fix or mitigate CVE-2026-45591?

Within 24 hours: conduct full inventory of ASP.NET Core versions and deployment scope; consult MSRC advisory CVE-2026-45591 to identify affected versions; establish incident response procedures for DoS event mitigation. Within 7 days: deploy and test rate limiting, connection throttling, and request queuing on all internet-facing ASP.NET Core systems; activate Web Application Firewall with anti-DDoS protection rules; configure application timeout and resource exhaustion monitoring. Within 30 days: monitor Microsoft's security bulletin cycle for patch release; establish rapid patch deployment procedures; implement comprehensive resource saturation metrics; plan staged rollout and testing when patches become available.

ASP.NET Core CVE-2026-45591

EUVD-2026-35549 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-09 secure@microsoft.com

GHSA-f8h2-vmm9-qhj6

Denial Of Service Microsoft Net Asp Net Core Visual Studio 2026

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.5 MEDIUM

cvss

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:15 vuln.today

DescriptionCVE.org

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

AnalysisAI

Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disrupt application availability. The CVSS 7.5 score reflects high availability impact with low attack complexity and no required privileges or user interaction, though no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the reporting source via MSRC, indicating a vendor-coordinated disclosure.

Technical ContextAI

ASP.NET Core is Microsoft's cross-platform, open-source web framework for building modern HTTP-based services and web applications, running on Windows, Linux, and macOS via the .NET runtime and Kestrel web server. The root cause falls under CWE-400 (Uncontrolled Resource Consumption), meaning the framework fails to properly limit allocation of CPU, memory, threads, connections, or other finite resources when processing attacker-controlled input. Such flaws in ASP.NET Core typically manifest in request parsing, header processing, model binding, or middleware pipelines where unbounded input is accepted and processed without throttling. Specific affected components and versions are not disclosed in available data - the MSRC advisory is the authoritative source.

RemediationAI

Patch available per vendor advisory - apply the ASP.NET Core security updates published by Microsoft as referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591, updating both the runtime and the ASP.NET Core Hosting Bundle (for IIS-hosted apps) to the fixed versions listed there, and redeploy self-contained applications rebuilt against the patched SDK. Until patching is complete, compensating controls include placing affected applications behind a reverse proxy or WAF (such as Azure Front Door, Application Gateway, or nginx) configured with aggressive request-rate limits, connection limits, and request timeouts - note the trade-off that legitimate bursty clients may be throttled. Additionally, configure Kestrel server limits (MaxConcurrentConnections, MaxRequestBodySize, RequestHeadersTimeout, KeepAliveTimeout) to bound resource usage per connection, which reduces blast radius but may break long-polling or large-upload workloads if set too tightly. Exact fixed version numbers are not provided in the input data and must be read from the MSRC advisory.