EUVD-2026-44045
GHSA-j8gr-8fp3-5q5h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ASP.NET Core endpoint
-
DeliverySend crafted/high-volume requests
-
ExploitTrigger unbounded resource allocation
-
ExecutionExhaust memory or connection pool
-
ImpactDeny service to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The application must be an ASP.NET Core service on .NET 8.0, 9.0, or 10.0 that is network-reachable by the attacker, and the vulnerable request-handling path must be exposed (typically any HTTP endpoint served by the affected framework). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no elevated privileges, and no user interaction are required, so default deployments of internet-facing ASP.NET Core apps are exploitable. Limiting factors are primarily deployment-based: services reachable only from trusted internal networks, or fronted by a proxy/WAF that already enforces rate limiting and request size caps, substantially reduce realistic exposure; impact is confined to availability, with no data disclosure or code execution. |
| Impact | The CVSS 3.1 base is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - network-reachable, low complexity, no privileges, no user interaction, and a pure availability impact (no confidentiality or integrity loss). This is a classic remotely-triggerable DoS: easy to reach and reproduce, but it cannot be used to steal data or execute code. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; no CISA KEV listing and no POC were supplied, so there is no evidence of active exploitation. SSVC-style read: exploitation is 'none' observed, technical impact is partial (availability only), and while a DoS of this class is often automatable, that is not confirmed by the input. Net: a genuine High-severity availability risk for internet-facing ASP.NET Core services that should be patched on a normal-but-prompt cadence, but it is not the drop-everything urgency of an actively exploited RCE. |
| Exploit ScenarioDerived | An attacker who can reach an internet-facing ASP.NET Core application sends a stream of crafted requests that each force the framework to allocate resources without any enforced cap, rapidly driving memory or thread/connection exhaustion until the process becomes unresponsive or crashes. No authentication, credentials, or user interaction is required (PR:N/UI:N), so the attack can be scripted against any exposed endpoint; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Denial of service in ASP.NET Core (the web framework shipped with .NET 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker exhaust server resources by triggering unbounded allocations over the network. Because affected requests are not throttled or capped, a single crafted request stream can degrade availability of the hosting process without any authentication or user interaction. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and no CISA KEV listing.
RemediationAI
Patch available per vendor advisory - apply the updated .NET 8.0, 9.0, or 10.0 runtime/SDK builds published in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170, then rebuild/redeploy applications or update the shared framework on hosts and restart the affected ASP.NET Core processes. The exact patched version strings are listed in that advisory and should be taken directly from it rather than assumed. As compensating controls until patching, place a reverse proxy or WAF in front of Kestrel to enforce request-rate limiting and request/body size caps, enable ASP.NET Core's built-in rate-limiting and request-body/size limits (MaxRequestBodySize, connection and header limits) where applicable, and restrict exposure of the affected endpoints to trusted networks; the trade-off is that aggressive limits can throttle legitimate high-volume clients and require tuning to avoid false-positive request rejection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 15 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) weakness in ASP.NET Core, Microsoft's cross-platform web application framework and Kestrel-based HTTP stack bundled into the .NET runtime. The affected CPEs are the .NET 8.0, 9.0, and 10.0 platforms (cpe:2.3:a:microsoft:.net_8.0/9.0/10.0). CWE-770 root cause means the framework accepts attacker-influenced input that drives memory, CPU, connection, or object allocation without applying an upper bound or rate limit, so an attacker can force the process to consume resources faster than it can reclaim them, culminating in memory pressure or thread/connection starvation and process failure.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable HTTP framework flaw needing no auth or interaction (AV:N/AC:L/PR:N/UI:N), causing availability loss only (A:H) with no confidentiality or integrity impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Executive ViewAI
ASP.NET Core in .NET 8.0, 9.0, and 10.0 is vulnerable to unauthenticated remote denial-of-service attacks that allow attackers to exhaust server resources and degrade application availability without credentials or user interaction. No public exploit identified at time of analysis; however, any organization running these .NET versions faces significant risk to business continuity and customer access. Patching is critical given the HIGH severity rating and ease of exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB