Skip to content
OpenAdvisories
High · 7.5 CVE-2026-109478 EUVD-2026-121561GHSA-r3qf-p3jm-8h4pGHSA-wrm2-c2h2-4w82

ASP.NET Core Denial of Service Vulnerability

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by microsoft

Vendor: Microsoft Product: .NET 8.0 installed on Linux Product: .NET 8.0 installed on Mac OS Product: .NET 8.0 installed on Windows Product: .NET 9.0 installed on Linux Product: .NET 9.0 installed on Mac OS Product: .NET 9.0 installed on Windows Product: Microsoft Visual Studio 2022 version 17.14 Product: Microsoft Visual Studio 2026 version 18.11 Product: Microsoft Visual Studio 2026 version 18.12 Package: dotnet-bootstrap-8 Package: dotnet6 Package: dotnet7 Package: dotnet8 Package: dotnet8-runtime Package: Microsoft.AspNetCore.App.Runtime.linux-arm Package: Microsoft.AspNetCore.App.Runtime.linux-arm64 Package: Microsoft.AspNetCore.App.Runtime.linux-musl-arm Package: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 Package: Microsoft.AspNetCore.App.Runtime.linux-musl-x64 Package: Microsoft.AspNetCore.App.Runtime.linux-x64 Package: Microsoft.AspNetCore.App.Runtime.osx-arm64 Package: Microsoft.AspNetCore.App.Runtime.osx-x64 Package: Microsoft.AspNetCore.App.Runtime.win-arm64 Package: Microsoft.AspNetCore.App.Runtime.win-x64 Package: Microsoft.AspNetCore.App.Runtime.win-x86 Platform: Linux Platform: macOS Platform: Windows Ecosystem: Alpine Ecosystem: NuGet Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products

VendorProductAffectedFixed
Microsoft .NET 8.0 installed on Linux 8.0.0 – < 8.0.34 8.0.34
Microsoft .NET 8.0 installed on Mac OS 8.0.0 – < 8.0.34 8.0.34
Microsoft .NET 8.0 installed on Windows 8.0.0 – < 8.0.34 8.0.34
Microsoft .NET 9.0 installed on Linux 9.0.0 – < 9.0.0-preview.4.24266.19 9.0.0-preview.4.24266.19
Microsoft .NET 9.0 installed on Mac OS 9.0.0 – < 9.0.0-preview.4.24266.19 9.0.0-preview.4.24266.19
Microsoft .NET 9.0 installed on Windows 9.0.0 – < 9.0.0-preview.4.24266.19 9.0.0-preview.4.24266.19
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – < 17.14.45 17.14.45
Microsoft Microsoft Visual Studio 2026 version 18.11 18.11.0 – < 18.11.4 18.11.4
Microsoft Microsoft Visual Studio 2026 version 18.12 18.12.0 – < 18.12.0 18.12.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 dotnet10 10.0.115-10.0.15-0ubuntu1~26.10.1 USN-9042-1
Ubuntu 26.10 dotnet11 11.0.100-11.0.0-0ubuntu1~26.10.1 USN-9042-1
Ubuntu 26.04 LTS dotnet10 10.0.115-10.0.15-0ubuntu1~26.04.1 USN-9042-1
Ubuntu 24.04 LTS dotnet10 10.0.115-10.0.15-0ubuntu1~24.04.1 USN-9042-1
Ubuntu 24.04 LTS dotnet8 8.0.134-8.0.34-0ubuntu1~24.04.1 USN-9042-1
Ubuntu 22.04 LTS dotnet6 +1 No fix yet —
Ubuntu 22.04 LTS dotnet8 8.0.134-8.0.34-0ubuntu1~22.04.1 USN-9042-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 dotnet-hostfxr-8.0 +7 8.0.34-1.el10_3 RHSA-2026:99147
RHEL 10 dotnet8.0 +4 8.0.134-1.el10_3 RHSA-2026:99147
RHEL 9 dotnet-hostfxr-8.0 +7 8.0.34-1.el9_9 RHSA-2026:99146
RHEL 9 dotnet8.0 +4 8.0.134-1.el9_9 RHSA-2026:99146
RHEL 8 dotnet-hostfxr-8.0 +7 8.0.34-1.el8_10 RHSA-2026:99052
RHEL 8 dotnet8.0 +4 8.0.134-1.el8_10 RHSA-2026:99052

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 dotnet-hostfxr-8.0 +7 8.0.34-1.el8_10 ALSA-2026:99052
AlmaLinux 8 dotnet-sdk-8.0 +3 8.0.134-1.el8_10 ALSA-2026:99052

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 dotnet-hostfxr-8.0 +7 8.0.34-1.el8_10 RLSA-2026:99052
Rocky Linux 8 dotnet-sdk-8.0 +3 8.0.134-1.el8_10 RLSA-2026:99052

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 dotnet8-runtime 8.0.34-r0 —
Alpine v3.23 dotnet8-runtime 8.0.34-r0 —
Alpine v3.22 dotnet8-runtime 8.0.34-r0 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling dotnet-bootstrap-8 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 9.0.0-preview.1.24081.5, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 9.0.0-preview.2.24128.4, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 9.0.0-preview.3.24172.13, < 9.0.0-preview.4.24267.6 9.0.0-preview.4.24267.6 GHSA-r3qf-p3jm-8h4p

Advisories 9

References