ASP.NET Core CVE-2026-69304

Exploitation requires that the target application runs a vulnerable ASP.NET Core version (8.0.0-8.0.30, 9.0.0-9.0.19, 10.0.0-10.0.11, or 11.0 pre-RC1) and has decompression middleware or request-body decompression handlers active in its pipeline - the CVSS AC:H metric explicitly signals this configuration dependency. The attacker must be able to reach the application over the network and send a crafted compressed HTTP request; no authentication is required (PR:N) and no user interaction is needed (UI:N). Limiting factors are: the AC:H condition (only endpoints that decompress attacker-controlled content are affected, not all ASP.NET Core deployments by default), the availability-only impact (no data exfiltration is possible), and unchanged scope (the attack cannot pivot to other systems).

The CVSS score of 5.9 (Medium) reflects the AC:H qualifier, indicating that exploitation depends on the target application having decompression middleware or specific request-handling paths active - not all ASP.NET Core deployments expose this surface by default. The impact is purely availability (A:H, S:U), with no confidentiality or integrity exposure. No public exploit or proof-of-concept has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; EPSS data was not provided. Despite the medium score, public-facing ASP.NET Core APIs that accept compressed request bodies face meaningful denial-of-service risk because a single crafted request can trigger disproportionate resource consumption. The breadth of affected versions - eight distinct version lines including Visual Studio - increases the total patch surface for enterprise teams but all fixes are vendor-released and available now, making this a standard scheduled-patching priority rather than an emergency response item.

An unauthenticated attacker sends a crafted HTTP POST request with a Content-Encoding header to a public-facing ASP.NET Core endpoint that decompresses client-supplied request bodies. The compressed payload - small on the wire - expands to gigabytes of data during server-side decompression, rapidly exhausting available memory or CPU. The worker process crashes or becomes unresponsive, denying service to legitimate users; no authentication or user interaction is required, though AC:H suggests specific middleware or endpoint configuration must be present.