ASP.NET Core CVE-2026-70196

Exploitation requires a reachable ASP.NET Core application endpoint that accepts and parses HTTP form data via Microsoft.AspNetCore.WebUtilities FormPipeReader, running an affected runtime (8.0.0-8.0.31, 9.0 before 9.0.21, or 10.0 before 10.0.13). The attacker must deliver the form body incrementally (e.g., many small chunks) so the parser repeatedly rescans the full buffered body, producing quadratic CPU cost. Limiting factors: only applications that process form submissions are exposed; impact is confined to availability (no data disclosure or modification); and the required incremental-delivery technique is reflected in the AC:H rating, making trivial single-request abuse less likely. No authentication is required (PR:N).

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9) describes a network-reachable, unauthenticated flaw with impact limited to availability only - consistent with the CWE-407 algorithmic-complexity denial of service in Microsoft.AspNetCore.WebUtilities FormPipeReader. The signals are internally consistent rather than conflicting: AC:H reflects that the attacker must deliver form data in an incremental/chunked manner to trigger quadratic CPU consumption, and the CISA SSVC decision framework corroborates a lower urgency (Exploitation: none, Automatable: no, Technical Impact: partial). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of real-world exploitation - this is a high-impact-ceiling (A:H) but availability-only, moderate-severity issue, not a critical priority. Note one data-quality concern: the input Tags label this 'Authentication Bypass', which directly contradicts the description, CWE-407, and the vendor GHSA advisory (all of which describe a denial of service with no confidentiality or integrity impact) - the tag appears mislabeled and should not drive triage. SSVC 'Automatable: no' plus AC:H suggests any exploitation would be deliberate and targeted rather than mass/wormable.

An unauthenticated remote attacker identifies an ASP.NET Core endpoint that accepts form submissions and sends a form body delivered in many small increments, causing FormPipeReader to repeatedly rescan the full buffered body. The resulting quadratic CPU consumption exhausts server processing capacity and denies service to legitimate users. No public exploit code was identified at time of analysis, and the attack requires specific incremental delivery (reflected in CVSS AC:H).