Description
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft.AspNetCore.WebUtilities | 2.3.12 – < 2.3.14 | 2.3.14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | dotnet7 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.AspNetCore.WebUtilities | >= 2.3.0, < 2.3.14 | 2.3.14 | GHSA-6527-9fp8-r4x6 |
Advisories 2
- MSRC-CVE-2026-118750 ASP.NET Core Denial of Service Vulnerability Microsoft Security Response Center · Nov 11, 2026
- NCSC-2026-0473 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · Nov 10, 2026
References
- ASP.NET Core Denial of Service Vulnerability vendor-advisory patch