CVE-2026-114154
ASP.NET Core Denial of Service Vulnerability
CVE-2026-114154 is a high vulnerability (CVSS 7.5) in Microsoft .net 10.0 Installed On Windows, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.30%, the 70th percentile. Fixed in Microsoft.AspNetCore.Server.HttpSys 2.3.14.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 1.30%EPSS, 70th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.14Microsoft.AspNetCore.Server.HttpSys +33 more
Description
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Discussion
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.10 to 2.3.10 | 2.3.14 |
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.11 to 2.3.11 | 2.3.14 |
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.12 to 2.3.12 | 2.3.14 |
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.13 to 2.3.13 | 2.3.14 |
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet | 8.0.0 to 8.0.33 | 8.0.34 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet | 8.0.0 to 8.0.33 | 8.0.34 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet | 8.0.0 to 8.0.33 | 8.0.34 |
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet | 9.0.0 to 9.0.22 | 9.0.23 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet | 9.0.0 to 9.0.22 | 9.0.23 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet | 9.0.0 to 9.0.22 | 9.0.23 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet | 10.0.0 to 10.0.14 | 10.0.15 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet | 10.0.0 to 10.0.14 | 10.0.15 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet | 10.0.0 to 10.0.14 | 10.0.15 |
dotnet10-runtimeAlpine:v3.24 | before 10.0.15-r0 | 10.0.15-r0 |
dotnet8-runtimeAlpine:v3.22 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet8-runtimeAlpine:v3.23 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet8-runtimeAlpine:v3.24 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet9-runtimeAlpine:v3.22 | before 9.0.23-r0 | 9.0.23-r0 |
dotnet9-runtimeAlpine:v3.23 | before 9.0.23-r0 | 9.0.23-r0 |
dotnet9-runtimeAlpine:v3.24 | before 9.0.23-r0 | 9.0.23-r0 |
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.10 up to 2.3.14, plus listed versions 2.3.112.3.122.3.13 | 2.3.14 |
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.11 up to 2.3.14, plus listed versions 2.3.122.3.13 | 2.3.14 |
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.12 up to 2.3.14, plus listed versions 2.3.13 | 2.3.14 |
Microsoft.AspNetCore.Server.HttpSysNuGet | 2.3.13 up to 2.3.14 | 2.3.14 |
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.AspNetCore.App.Runtime.win-arm64NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
Microsoft.AspNetCore.App.Runtime.win-x64NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
Microsoft.AspNetCore.App.Runtime.win-x86NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
dotnet7Ubuntu:22.04:LTS | All versions, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1 Show 9 moreShow less7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1 | None known |
What each source reports
CVE List Score used
ASP.NET Core Denial of Service Vulnerability
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Record
CVE-2026-114154- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness
- CWE-401
- Updated
- 2026-11-10
EUVDEUVD-2026-121977
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Record
EUVD-2026-121977- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-3893-7fxc-qvff
Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.
Malformed chunked HttpSys requests containing conflicting content-length headers can retain request and connection resources.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/513
CVSS Details
- Version: 3.1
- Severity: High
- Score: 7.5 (base score)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-401
Affected Platforms
- Platforms: Windows
- Architectures: All
<a name="affected-packages"></a>Affected Packages
The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.
ASP.NET Core 2.3 - standalone packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.Server.HttpSys | = 2.3.10 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.11 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.12 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.13 | 2.3.14
.NET 8.0 - affected runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.33 | 8.0.34
.NET 9.0 - affected runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.22 | 9.0.23
.NET 10.0 - affected runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.14 | 10.0.15
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.
<a name="how-fix"></a>How do I fix the issue?
Update standalone Microsoft.AspNetCore.Server.HttpSys references to 2.3.14, then rebuild and redeploy affected applications, including framework-dependent applications. Install the applicable patched runtime version listed above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.
Other Information
Reporting…
- Record
GHSA-3893-7fxc-qvff- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness
- CWE-401
- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-49q5-vjx7-5gwr
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references.
Original Description
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Record
GHSA-49q5-vjx7-5gwr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-10
NVD
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Record
CVE-2026-114154- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-10
OSVALPINE-CVE-2026-114154
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Record
ALPINE-CVE-2026-114154- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVGHSA-3893-7fxc-qvff
Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.
Malformed chunked HttpSys requests containing conflicting content-length headers can retain request and connection resources.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/513
CVSS Details
- Version: 3.1
- Severity: High
- Score: 7.5 (base score)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-401
Affected Platforms
- Platforms: Windows
- Architectures: All
<a name="affected-packages"></a>Affected Packages
The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.
ASP.NET Core 2.3 - standalone packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.Server.HttpSys | = 2.3.10 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.11 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.12 | 2.3.14 Microsoft.AspNetCore.Server.HttpSys | = 2.3.13 | 2.3.14
.NET 8.0 - affected runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.33 | 8.0.34
.NET 9.0 - affected runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.22 | 9.0.23
.NET 10.0 - affected runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.14 | 10.0.15
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.
<a name="how-fix"></a>How do I fix the issue?
Update standalone Microsoft.AspNetCore.Server.HttpSys references to 2.3.14, then rebuild and redeploy affected applications, including framework-dependent applications. Install the applicable patched runtime version listed above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.
Other Information
Reporting…
- Record
GHSA-3893-7fxc-qvff- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness
- CWE-401
- Updated
- 2026-11-11
OSVGHSA-49q5-vjx7-5gwr
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references.
Original Description
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Record
GHSA-49q5-vjx7-5gwr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-10
OSVUBUNTU-CVE-2026-114154
Malformed chunked HttpSys requests containing conflicting content-length headers can retain request and connection resources.
- Record
UBUNTU-CVE-2026-114154- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, published, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| affected, references | OSV | |
| affected, aliases, facts, references | GitHub Advisories | |
| published | EUVD | |
| references | GitHub Advisories, OSV | |
| published | CVE List, EUVD, NVD |
Show 4 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | GitHub Advisories | |
| products | EUVD | |
| cwes, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154
github.com/dotnet/aspnetcore/security/advisories/GHSA-3893-7fxc-qvff
Show 16 moreShow less
nvd.nist.gov/vuln/detail/cve-2026-114154
security.alpinelinux.org/vuln/CVE-2026-114154
ubuntu.com/security/CVE-2026-114154
cve.org/CVERecord?id=CVE-2026-114154
devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates
Left out here: the rest of 2 source descriptions. The JSON record has them.