What is the CVSS score of CVE-2026-56170?

CVE-2026-56170 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of ASP.NET Core are affected by CVE-2026-56170?

ASP.NET Core in .NET 8.0, 9.0, and 10.0 is vulnerable to unauthenticated remote denial-of-service attacks that allow attackers to exhaust server resources and degrade application availability without…. A patch is available.

How to fix or mitigate CVE-2026-56170?

Within 24 hours, identify and inventory all systems running ASP.NET Core on .NET 8.0, 9.0, or 10.0, prioritizing internet-facing and business-critical applications. Within 7 days, obtain and test the vendor-released patch in non-production environments to confirm compatibility, then deploy to all affected production systems during a scheduled maintenance window. Within 30 days, verify successful patch deployment by confirming updated .NET versions across all systems and reviewing access logs for any exploitation attempts during the vulnerability window.

ASP.NET Core CVE-2026-56170

EUVD-2026-44045 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-j8gr-8fp3-5q5h

Denial Of Service Microsoft Red Hat Suse Net 10 0 Net 8 0 Net 9 0

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Remotely reachable HTTP framework flaw needing no auth or interaction (AV:N/AC:L/PR:N/UI:N), causing availability loss only (A:H) with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:53 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 7.5

DescriptionCVE.org

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in ASP.NET Core (the web framework shipped with .NET 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker exhaust server resources by triggering unbounded allocations over the network. Because affected requests are not throttled or capped, a single crafted request stream can degrade availability of the hosting process without any authentication or user interaction. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) weakness in ASP.NET Core, Microsoft's cross-platform web application framework and Kestrel-based HTTP stack bundled into the .NET runtime. The affected CPEs are the .NET 8.0, 9.0, and 10.0 platforms (cpe:2.3:a:microsoft:.net_8.0/9.0/10.0). CWE-770 root cause means the framework accepts attacker-influenced input that drives memory, CPU, connection, or object allocation without applying an upper bound or rate limit, so an attacker can force the process to consume resources faster than it can reclaim them, culminating in memory pressure or thread/connection starvation and process failure.

RemediationAI

Patch available per vendor advisory - apply the updated .NET 8.0, 9.0, or 10.0 runtime/SDK builds published in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170, then rebuild/redeploy applications or update the shared framework on hosts and restart the affected ASP.NET Core processes. The exact patched version strings are listed in that advisory and should be taken directly from it rather than assumed. As compensating controls until patching, place a reverse proxy or WAF in front of Kestrel to enforce request-rate limiting and request/body size caps, enable ASP.NET Core's built-in rate-limiting and request-body/size limits (MaxRequestBodySize, connection and header limits) where applicable, and restrict exposure of the affected endpoints to trusted networks; the trade-off is that aggressive limits can throttle legitimate high-volume clients and require tuning to avoid false-positive request rejection.