EUVD-2026-43795
GHSA-x6c8-x7c4-fpqr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity DoS with no user interaction; availability-only impact (A:H) and no confidentiality or integrity loss, no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft's OData libraries for ASP.NET/ASP.NET Core (Microsoft.AspNet.OData and Microsoft.AspNetCore.OData) allows a remote, unauthenticated attacker to exhaust server resources over the network, degrading or crashing the hosting web application (CVSS 7.5, availability-only impact). The flaw stems from resource allocation without limits or throttling (CWE-770), so a crafted request stream forces excessive consumption of CPU, memory, or connections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application has enabled Microsoft's OData support - i.e., it references Microsoft.AspNet.OData or Microsoft.AspNetCore.OData and exposes OData-routed/queryable endpoints reachable over the network; the base ASP.NET Core framework without OData is not the indicated attack surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent for a genuine but bounded threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach an internet-facing OData endpoint sends one or a small number of crafted queries (for example, deeply nested $expand or expansive $filter/$batch requests) that force the server to allocate unbounded CPU or memory. Because exploitation requires no authentication, no user interaction, and only low attack complexity, a single attacker can repeat the request to keep the application unresponsive and deny service to legitimate users. … |
| Remediation | Patch available per vendor advisory: Microsoft has released a fix, so update the Microsoft.AspNet.OData and/or Microsoft.AspNetCore.OData NuGet packages to the patched version identified in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45646 (the exact fixed version is not included in this dataset and should be taken directly from that advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using Microsoft.AspNet.OData or Microsoft.AspNetCore.OData, document installed versions, and prioritize production web applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Aspnet Odata
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today