CVE-2026-26130

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft Security Advisory CVE-2026-26130 – .NET Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/385

CVSS Details

• Version: 3.1
• Score: 7.5
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
• Severity: High
• Weakness: CWE-770 (Uncontrolled Resource Consumption)

Affected Platforms

• Platforms: All
• Architectures: All

Affected Products

<a name=".NET 8"></a>.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, < =8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, < =8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, < =8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, < =8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, < =8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, < =8.0.24 | 8.0.25 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.24 | 8.0.25

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, < =9.0.13 | 9.0.14 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, < =9.0.13 | 9.0.14 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.13 | 9.0.14 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.13 | 9.0.14…

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

• .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)
• asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.