ASP.NET Core CVE-2026-96236

No special configuration conditions are stated - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation against a network-reachable ASP.NET Core application without user interaction. The practical limiting factor is exposure: the affected ASP.NET Core 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), or 11.0 (<11.0.0-rc.2) application (or the bundled Visual Studio 2022 17.14 <17.14.42 / 2026 18.10 <18.10.4 tooling) must be reachable by the attacker, and successful impact is limited to availability (C:N/I:N) - no data disclosure or code execution results. Standard upstream rate-limiting, request-size limits, or a WAF in front of the service would reduce the practical blast radius.

Signals are largely consistent and point to a genuine but bounded availability threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and HIGH availability impact - a classic resource-exhaustion denial-of-service consistent with CWE-770 (allocation of resources without limits or throttling). CISA's SSVC framework reinforces a measured priority: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'yes' (the unauthenticated network trigger can be scripted at scale), and Technical Impact is 'partial' (service degradation, not full system compromise). This is NOT in CISA KEV and no public exploit is identified, so despite the high 7.5 CVSS the real-world urgency is moderate: there is no evidence of active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. Because impact is confined to availability, this should be prioritized as a patch-in-cycle DoS issue for internet-facing ASP.NET Core services rather than an emergency, while recognizing the 'Automatable: yes' rating means it could be abused broadly if a technique becomes public.

A remote, unauthenticated attacker sends specially crafted requests to an internet-facing ASP.NET Core web application or API, causing the server to allocate memory, connections, or other resources without limit until the service becomes unresponsive and legitimately queued requests fail. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are needed once a triggering request pattern is known.