Every CVE Search/ Get API key

CVE-2025-26682

ASP.NET Core and Visual Studio Denial of Service Vulnerability

7.5 HighFix available

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.75%Down 0.5 points since Apr 9, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
CVE-2025-26682
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2025-10197 7.5

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
EUVD-2025-10197
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-gf2r-7cq8-xww9 7.5

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized...

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
GHSA-gf2r-7cq8-xww9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
NVD 7.5

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
CVE-2025-26682
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2025-26682 7.5

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
ALPINE-CVE-2025-26682
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2025-26682 7.5
Record
BELL-CVE-2025-26682
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSV 7.5

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
CVE-2025-26682
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-26682 7.5

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
UBUNTU-CVE-2025-26682
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-aspnet-core-2025-26682 No score

ASP.NET Core and Visual Studio Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Record
BIT-aspnet-core-2025-26682
Updated
2026-11-02
OSVUSN-7427-1 No score

dotnet8, dotnet9 vulnerability

James Newton-King discovered that .NET did not properly limit resource allocation when handling certain HTTP/3 requests. An attacker could possibly use this issue to cause a denial of service.

Record
USN-7427-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dotnet8-runtime
Alpine:v3.20
 before 8.0.15-r0
8.0.15-r0
dotnet8-runtime
Alpine:v3.21
 before 8.0.15-r0
8.0.15-r0
dotnet8-runtime
Alpine:v3.22
 before 8.0.15-r0
8.0.15-r0
dotnet8-runtime
Alpine:v3.23
 before 8.0.15-r0
8.0.15-r0
dotnet8-runtime
Alpine:v3.24
 before 8.0.15-r0
8.0.15-r0
dotnet9-runtime
Alpine:v3.21
 before 9.0.4-r0
9.0.4-r0
dotnet9-runtime
Alpine:v3.22
 before 9.0.4-r0
9.0.4-r0
dotnet9-runtime
Alpine:v3.23
 before 9.0.4-r0
9.0.4-r0
dotnet9-runtime
Alpine:v3.24
 before 9.0.4-r0
9.0.4-r0
dotnet8-runtime
Alpaquita:stream
 8.0.11-r1 up to 8.0.15-r0
8.0.15-r0
Show 7 moreShow less
Affected packages
PackageAffectedFixed
aspnet-core
Bitnami
 8.0.0 up to 8.0.15, 9.0.0 up to 9.0.4
8.0.159.0.4
dotnet6
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.0.108-0ubuntu1~22.04.16.0.109-0ubuntu1~22.04.16.0.110-0ubuntu1~22.04.16.0.111-0ubuntu1~22.04.16.0.113-0ubuntu1~22.04.1
Show 16 moreShow less
6.0.116-0ubuntu1~22.04.16.0.118-0ubuntu1~22.04.16.0.119-0ubuntu1~22.04.16.0.120-0ubuntu1~22.04.16.0.121-0ubuntu1~22.04.16.0.122-0ubuntu1~22.04.16.0.123-0ubuntu1~22.04.16.0.124-0ubuntu1~22.04.16.0.125-0ubuntu1~22.04.16.0.126-0ubuntu1~22.04.16.0.127-0ubuntu1~22.04.16.0.128-0ubuntu1~22.04.26.0.132-0ubuntu1~22.04.16.0.133-0ubuntu1~22.04.16.0.135-0ubuntu1~22.04.16.0.136-0ubuntu1~22.04.1
 None known
dotnet7
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1
Show 9 moreShow less
7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1
 None known
dotnet8
Ubuntu:22.04:LTS
 before 8.0.115-8.0.15-0ubuntu1~22.04.1, plus listed versions
8.0.102-8.0.2-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.28.0.105-8.0.5-0ubuntu1~22.04.18.0.107-8.0.7-0ubuntu1~22.04.1
Show 5 moreShow less
8.0.108-8.0.8-0ubuntu1~22.04.18.0.110-8.0.10-0ubuntu1~22.04.18.0.111-8.0.11-0ubuntu1~22.04.18.0.112-8.0.12-0ubuntu1~22.04.18.0.114-8.0.14-0ubuntu1~22.04.1
8.0.115-8.0.15-0ubuntu1~22.04.1
dotnet8
Ubuntu:24.04:LTS
 before 8.0.115-8.0.15-0ubuntu1~24.04.1, plus listed versions
8.0.100-8.0.0~rc1-0ubuntu18.0.100-8.0.0~rc2-0ubuntu18.0.100-8.0.0~rc2-0ubuntu28.0.100-8.0.0-0ubuntu18.0.100-8.0.0-0ubuntu2
Show 14 moreShow less
8.0.101-8.0.1-0ubuntu18.0.101-8.0.1-0ubuntu28.0.102-8.0.2-0ubuntu18.0.103-8.0.3-0ubuntu28.0.103-8.0.3-0ubuntu38.0.104-8.0.4-0ubuntu18.0.105-8.0.5-0ubuntu1~24.04.18.0.107-8.0.7-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.28.0.110-8.0.10-0ubuntu1~24.04.18.0.111-8.0.11-0ubuntu1~24.04.18.0.112-8.0.12-0ubuntu1~24.04.18.0.114-8.0.14-0ubuntu1~24.04.1
8.0.115-8.0.15-0ubuntu1~24.04.1
dotnet8
Ubuntu:25.10
 before 8.0.115-8.0.15-0ubuntu1
8.0.115-8.0.15-0ubuntu1
dotnet9
Ubuntu:25.10
 before 9.0.105-9.0.4-0ubuntu1
9.0.105-9.0.4-0ubuntu1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-26682 is a high vulnerability (CVSS 7.5) in Microsoft Asp.net Core, published April 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.75%, the 77th percentile. Fixed in dotnet8-runtime 8.0.15-r0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open