EUVD-2026-73886
GHSA-7whw-q9mg-h337
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable OData endpoint, no auth needed, pure availability DoS with no confidentiality or integrity impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
AnalysisAI
Unthrottled resource allocation in Microsoft.AspNetCore.OData exposes ASP.NET Core applications to network-based denial of service by unauthenticated remote attackers. The root cause (CWE-770) allows crafted OData protocol requests - such as deeply nested $expand, expensive $filter expressions, or unbounded batch operations - to consume server memory or CPU without limit until the service becomes unavailable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target ASP.NET Core application must expose an OData endpoint using the Microsoft.AspNetCore.OData NuGet package in an affected version, and that endpoint must be reachable over the network by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly characterizes a high-availability-impact, zero-auth, low-complexity network DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Microsoft.AspNetCore.OData NuGet package to the patched version per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57099. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all ASP.NET Core applications using Microsoft.AspNetCore.OData and evaluate which are internet-facing or untrusted-network accessible; prioritize immediate patching of exposed instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today