{"id":"CVE-2025-26682","aliases":["ALPINE-CVE-2025-26682","BELL-CVE-2025-26682","BIT-aspnet-core-2025-26682","EUVD-2025-10197","GHSA-gf2r-7cq8-xww9","UBUNTU-CVE-2025-26682","USN-7427-1"],"status":"published","title":"ASP.NET Core and Visual Studio Denial of Service Vulnerability","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01749,"percentile":0.78042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2025-04-08T00:00:00Z","modified":"2026-11-03T06:32:51Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"dotnet8-runtime","fixed_in":["8.0.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dotnet8-runtime","fixed_in":["8.0.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dotnet8-runtime","fixed_in":["8.0.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dotnet8-runtime","fixed_in":["8.0.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dotnet8-runtime","fixed_in":["8.0.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dotnet9-runtime","fixed_in":["9.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dotnet9-runtime","fixed_in":["9.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dotnet9-runtime","fixed_in":["9.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dotnet9-runtime","fixed_in":["9.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"dotnet8-runtime","fixed_in":["8.0.15-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"aspnet-core","fixed_in":["8.0.15","9.0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"dotnet8","fixed_in":["8.0.115-8.0.15-0ubuntu1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"dotnet8","fixed_in":["8.0.115-8.0.15-0ubuntu1~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dotnet8","fixed_in":["8.0.115-8.0.15-0ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dotnet9","fixed_in":["9.0.105-9.0.4-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.11-r1"},{"fixed":"8.0.15-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"aspnet-core","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.15"},{"introduced":"9.0.0"},{"fixed":"9.0.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.108-0ubuntu1~22.04.1","6.0.109-0ubuntu1~22.04.1","6.0.110-0ubuntu1~22.04.1","6.0.111-0ubuntu1~22.04.1","6.0.113-0ubuntu1~22.04.1","6.0.116-0ubuntu1~22.04.1","6.0.118-0ubuntu1~22.04.1","6.0.119-0ubuntu1~22.04.1","6.0.120-0ubuntu1~22.04.1","6.0.121-0ubuntu1~22.04.1","6.0.122-0ubuntu1~22.04.1","6.0.123-0ubuntu1~22.04.1","6.0.124-0ubuntu1~22.04.1","6.0.125-0ubuntu1~22.04.1","6.0.126-0ubuntu1~22.04.1","6.0.127-0ubuntu1~22.04.1","6.0.128-0ubuntu1~22.04.2","6.0.132-0ubuntu1~22.04.1","6.0.133-0ubuntu1~22.04.1","6.0.135-0ubuntu1~22.04.1","6.0.136-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.105-0ubuntu1~22.04.1","7.0.107-0ubuntu1~22.04.1","7.0.108-0ubuntu1~22.04.1","7.0.109-0ubuntu1~22.04.1","7.0.110-0ubuntu1~22.04.1","7.0.111-0ubuntu1~22.04.1","7.0.112-0ubuntu1~22.04.1","7.0.113-0ubuntu1~22.04.1","7.0.114-0ubuntu1~22.04.1","7.0.115-0ubuntu1~22.04.1","7.0.116-0ubuntu1~22.04.1","7.0.117-0ubuntu1~22.04.1","7.0.117-0ubuntu1~22.04.2","7.0.119-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.115-8.0.15-0ubuntu1~22.04.1"}]}],"versions":["8.0.102-8.0.2-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.2","8.0.105-8.0.5-0ubuntu1~22.04.1","8.0.107-8.0.7-0ubuntu1~22.04.1","8.0.108-8.0.8-0ubuntu1~22.04.1","8.0.110-8.0.10-0ubuntu1~22.04.1","8.0.111-8.0.11-0ubuntu1~22.04.1","8.0.112-8.0.12-0ubuntu1~22.04.1","8.0.114-8.0.14-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.115-8.0.15-0ubuntu1~24.04.1"}]}],"versions":["8.0.100-8.0.0~rc1-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu2","8.0.100-8.0.0-0ubuntu1","8.0.100-8.0.0-0ubuntu2","8.0.101-8.0.1-0ubuntu1","8.0.101-8.0.1-0ubuntu2","8.0.102-8.0.2-0ubuntu1","8.0.103-8.0.3-0ubuntu2","8.0.103-8.0.3-0ubuntu3","8.0.104-8.0.4-0ubuntu1","8.0.105-8.0.5-0ubuntu1~24.04.1","8.0.107-8.0.7-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.2","8.0.110-8.0.10-0ubuntu1~24.04.1","8.0.111-8.0.11-0ubuntu1~24.04.1","8.0.112-8.0.12-0ubuntu1~24.04.1","8.0.114-8.0.14-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.115-8.0.15-0ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dotnet9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.105-9.0.4-0ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.115-8.0.15-0ubuntu1~22.04.1"}]}],"versions":["8.0.102-8.0.2-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.1","8.0.103-8.0.3-0ubuntu1~22.04.2","8.0.105-8.0.5-0ubuntu1~22.04.1","8.0.107-8.0.7-0ubuntu1~22.04.1","8.0.108-8.0.8-0ubuntu1~22.04.1","8.0.110-8.0.10-0ubuntu1~22.04.1","8.0.111-8.0.11-0ubuntu1~22.04.1","8.0.112-8.0.12-0ubuntu1~22.04.1","8.0.114-8.0.14-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dotnet8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.115-8.0.15-0ubuntu1~24.04.1"}]}],"versions":["8.0.100-8.0.0~rc1-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu1","8.0.100-8.0.0~rc2-0ubuntu2","8.0.100-8.0.0-0ubuntu1","8.0.100-8.0.0-0ubuntu2","8.0.101-8.0.1-0ubuntu1","8.0.101-8.0.1-0ubuntu2","8.0.102-8.0.2-0ubuntu1","8.0.103-8.0.3-0ubuntu2","8.0.103-8.0.3-0ubuntu3","8.0.104-8.0.4-0ubuntu1","8.0.105-8.0.5-0ubuntu1~24.04.1","8.0.107-8.0.7-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.1","8.0.108-8.0.8-0ubuntu1~24.04.2","8.0.110-8.0.10-0ubuntu1~24.04.1","8.0.111-8.0.11-0ubuntu1~24.04.1","8.0.112-8.0.12-0ubuntu1~24.04.1","8.0.114-8.0.14-0ubuntu1~24.04.1"]}],"products":[{"vendor":"microsoft","product":"asp.net core 8.0"},{"vendor":"microsoft","product":"asp.net core 9.0"},{"vendor":"microsoft","product":"asp.net_core"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.10"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.12"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.13"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.8"},{"vendor":"microsoft","product":"visual_studio_2022"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26682","tags":["vendor-advisory","patch","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26682","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gf2r-7cq8-xww9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-26682","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-26682","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-26682","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-26682","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7427-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-26682","title":"ASP.NET Core and Visual Studio Denial of Service Vulnerability","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-04-08T17:24:22.748Z","modified":"2026-08-10T15:13:20.349Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:27.932735Z"}],"euvd":[{"id":"EUVD-2025-10197","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-04-08T17:24:22Z","modified":"2026-08-10T15:13:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T18:02:02.39155Z"}],"ghsa":[{"id":"GHSA-gf2r-7cq8-xww9","title":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized...","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-04-08T18:34:49Z","modified":"2025-04-08T18:34:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:00:51.102649Z"}],"nvd":[{"id":"CVE-2025-26682","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-04-08T18:15:53.033Z","modified":"2026-06-17T09:02:16.77Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:10:59.48027Z"}],"osv":[{"id":"ALPINE-CVE-2025-26682","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-04-08T18:15:53.033Z","modified":"2026-11-03T06:32:51.177279542Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"BELL-CVE-2025-26682","status":"published","published":"2025-04-09T05:58:01.526057Z","modified":"2026-01-26T09:39:05.207527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.741325Z"},{"id":"CVE-2025-26682","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-04-08T18:15:53.033Z","modified":"2026-10-24T10:30:25.667662472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"UBUNTU-CVE-2025-26682","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-04-08T00:00:00Z","modified":"2026-02-04T03:34:06.845535Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"BIT-aspnet-core-2025-26682","title":"ASP.NET Core and Visual Studio Denial of Service Vulnerability","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","status":"published","published":"2025-07-10T05:35:46.382Z","modified":"2026-09-08T08:45:36.193919045Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"USN-7427-1","title":"dotnet8, dotnet9 vulnerability","description":"James Newton-King discovered that .NET did not properly limit resource\nallocation when handling certain HTTP/3 requests. An attacker could\npossibly use this issue to cause a denial of service.\n","status":"published","published":"2025-04-08T21:14:50Z","modified":"2026-04-27T17:48:36.700806Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}