high7.5

CVE-2026-96236

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Impact

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Ecosystem	Package	Affected	Fixed in
nuget	`Microsoft.AspNetCore.App.Runtime.linux-arm`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.osx-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.osx-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-x86`	>= 8.0.0, <= 8.0.31	8.0.32

Vendor	Product	Affected versions
Microsoft	ASP.NET Core 10.0	from 10.0 before 10.0.13
Microsoft	Microsoft Visual Studio 2026 Version 18.10	from 18.10.0 before 18.10.4
Microsoft	ASP.NET Core 8.0	from 8.0 before 8.0.32
Microsoft	ASP.NET Core 11.0	from 11.0 before 11.0.0-rc.2
Microsoft	Microsoft Visual Studio 2022 Version 17.14	from 17.14.0 before 17.14.42
Microsoft	ASP.NET Core 9.0	from 9.0 before 9.0.21