medium5.9

CVE-2026-70196

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Impact

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Ecosystem	Package	Affected	Fixed in
nuget	`Microsoft.AspNetCore.App.Runtime.linux-arm`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.osx-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.osx-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-arm`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-x86`	>= 8.0.0, <= 8.0.31	8.0.32

Vendor	Product	Affected versions
Microsoft	ASP.NET Core 8.0	from 8.0 before 8.0.32
Microsoft	Microsoft Visual Studio 2026 Version 18.10	from 18.10.0 before 18.10.4
Microsoft	ASP.NET Core 9.0	from 9.0 before 9.0.21
Microsoft	Microsoft Visual Studio 2022 Version 17.14	from 17.14.0 before 17.14.42
Microsoft	ASP.NET Core 10.0	from 10.0 before 10.0.13