What is the CVSS score of CVE-2026-45646?

CVE-2026-45646 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

How to fix or mitigate CVE-2026-45646?

Within 24 hours, identify all systems using Microsoft.AspNet.OData or Microsoft.AspNetCore.OData, document installed versions, and prioritize production web applications. Within 7 days, apply the patch available per vendor advisory to all affected deployments, beginning with internet-facing ASP.NET and ASP.NET Core services. Within 30 days, validate patch installation through load testing of OData endpoints, review application logs for resource-exhaustion patterns during the remediation window, and confirm normal performance restoration.

ASP.NET Core OData CVE-2026-45646

Q: Which versions of ASP.NET Core OData are affected by CVE-2026-45646?

CVE-2026-45646 is a denial-of-service vulnerability in Microsoft's OData libraries (Microsoft.AspNet.OData and Microsoft.AspNetCore.OData) enabling remote, unauthenticated attackers to exhaust server…. A patch is available.

EUVD-2026-43795 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-x6c8-x7c4-fpqr

Denial Of Service Microsoft Red Hat Aspnet Odata Aspnetcore Odata

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity DoS with no user interaction; availability-only impact (A:H) and no confidentiality or integrity loss, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:39 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 7.5

DescriptionCVE.org

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft's OData libraries for ASP.NET/ASP.NET Core (Microsoft.AspNet.OData and Microsoft.AspNetCore.OData) allows a remote, unauthenticated attacker to exhaust server resources over the network, degrading or crashing the hosting web application (CVSS 7.5, availability-only impact). The flaw stems from resource allocation without limits or throttling (CWE-770), so a crafted request stream forces excessive consumption of CPU, memory, or connections. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected technology is OData (Open Data Protocol), a query-rich REST convention Microsoft ships as the Microsoft.AspNet.OData and Microsoft.AspNetCore.OData NuGet packages (identified in the CPE strings cpe:2.3:a:microsoft:aspnet.odata and cpe:2.3:a:microsoft:aspnetcore.odata). These libraries let developers expose queryable API endpoints where clients pass expressive query options (e.g., $filter, $expand, $orderby, $top, batching). The root cause is CWE-770, Allocation of Resources Without Limits or Throttling: the OData request/query pipeline processes attacker-influenced input without enforcing an upper bound on the work or memory it may consume, so a single small request can be amplified into a large, unbounded server-side operation. Because the description attributes this to 'ASP.NET Core' while the CPE data pins it specifically to the OData add-on packages, the true attack surface is applications that have opted into OData routing/query support, not the base framework.

RemediationAI

Patch available per vendor advisory: Microsoft has released a fix, so update the Microsoft.AspNet.OData and/or Microsoft.AspNetCore.OData NuGet packages to the patched version identified in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45646 (the exact fixed version is not included in this dataset and should be taken directly from that advisory). Until you can deploy the update, apply OData-level throttling: configure server-side query constraints via EnableQueryAttribute / ODataQuerySettings such as MaxTop, MaxExpansionDepth, MaxNodeCount, and MaxAnyAllExpressionDepth to cap query cost, and disable or restrict $batch handling if unused (trade-off: legitimate large or deeply nested queries may be rejected). As compensating controls, put the OData endpoints behind rate limiting (ASP.NET Core rate-limiting middleware or an upstream WAF/reverse proxy), require authentication on OData routes if the business allows, and set request size and connection limits at the host (trade-off: added latency and possible false-positive throttling of heavy but legitimate clients). If OData is not needed, remove the packages/routing entirely.