What is the CVSS score of CVE-2026-50506?

CVE-2026-50506 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of Aspnet Odata are affected by CVE-2026-50506?

Microsoft's ASP.NET OData libraries contain a vulnerability allowing unauthenticated remote denial-of-service attacks against exposed API endpoints.. A patch is available.

How to fix or mitigate CVE-2026-50506?

Within 24 hours, catalog all web applications and APIs using Microsoft.AspNetCore.OData or Microsoft.AspNet.OData packages. Within 7 days, apply vendor-released patches to all affected instances across development, staging, and production. Within 30 days, validate OData endpoint functionality post-patch and document completion.

Aspnet Odata CVE-2026-50506

EUVD-2026-43991 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-9xvv-3v2j-fmmm

Denial Of Service Microsoft Red Hat Aspnet Odata Aspnetcore Odata

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.5 MEDIUM

cvss

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:18 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 7.5

DescriptionCVE.org

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

AnalysisAI

Uncontrolled resource allocation in Microsoft's ASP.NET Core OData libraries (Microsoft.AspNetCore.OData and Microsoft.AspNet.OData) lets a remote, unauthenticated attacker exhaust server resources and cause a denial of service over the network. Any web application or API exposing OData query endpoints built on the affected packages is at risk, and the CVSS 7.5 rating reflects a high-availability impact with no confidentiality or integrity compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.