CVE-2026-96236 — ASP.NET Core Denial of Service Vulnerability

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	ASP.NET Core 10.0	10.0 – < 10.0.13	10.0.13
Microsoft	ASP.NET Core 11.0	11.0 – < 11.0.0-rc.2	11.0.0-rc.2
Microsoft	ASP.NET Core 8.0	8.0 – < 8.0.32	8.0.32
Microsoft	ASP.NET Core 9.0	9.0 – < 9.0.21	9.0.21
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0 – < 17.14.42	17.14.42
Microsoft	Microsoft Visual Studio 2026 version 18.10	18.10.0 – < 18.10.4	18.10.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	dotnet10	10.0.113-10.0.13-0ubuntu1~26.10.1	USN-8942-1
Ubuntu 26.10	dotnet11	11.0.100-11.0.0~rc2-0ubuntu1~26.10.1	USN-8942-1
Ubuntu 26.04 LTS	dotnet10	10.0.113-10.0.13-0ubuntu1~26.04.1	USN-8942-1
Ubuntu 24.04 LTS	dotnet10	10.0.113-10.0.13-0ubuntu1~24.04.1	USN-8942-1
Ubuntu 24.04 LTS	dotnet8	8.0.132-8.0.32-0ubuntu1~24.04.1	USN-8942-1
Ubuntu 22.04 LTS	dotnet6 +1	No fix yet	—
Ubuntu 22.04 LTS	dotnet8	8.0.132-8.0.32-0ubuntu1~22.04.1	USN-8942-1

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	dotnet-host +8	10.0.13-1.el10_2	ALSA-2026:86195
AlmaLinux 10	dotnet-hostfxr-8.0 +7	8.0.32-1.el10_2	ALSA-2026:86168
AlmaLinux 10	dotnet-hostfxr-9.0 +7	9.0.21-1.el10_2	ALSA-2026:86172
AlmaLinux 10	dotnet-sdk-10.0 +4	10.0.113-1.el10_2	ALSA-2026:86195
AlmaLinux 10	dotnet-sdk-8.0 +3	8.0.132-1.el10_2	ALSA-2026:86168
AlmaLinux 10	dotnet-sdk-9.0 +5	9.0.122-1.el10_2	ALSA-2026:86172
AlmaLinux 9	dotnet-host +8	10.0.13-1.el9_8	ALSA-2026:86193
AlmaLinux 9	dotnet-hostfxr-8.0 +7	8.0.32-1.el9_8	ALSA-2026:86169
AlmaLinux 9	dotnet-hostfxr-9.0 +7	9.0.21-1.el9_8	ALSA-2026:86171
AlmaLinux 9	dotnet-sdk-10.0 +4	10.0.113-1.el9_8	ALSA-2026:86193
AlmaLinux 9	dotnet-sdk-8.0 +3	8.0.132-1.el9_8	ALSA-2026:86169
AlmaLinux 9	dotnet-sdk-9.0 +5	9.0.122-1.el9_8	ALSA-2026:86171
AlmaLinux 8	dotnet +5	10.0.113-1.el8_10	ALSA-2026:86192
AlmaLinux 8	dotnet-hostfxr-10.0 +7	10.0.13-1.el8_10	ALSA-2026:86192
AlmaLinux 8	dotnet-hostfxr-8.0 +7	8.0.32-2.el8_10	ALSA-2026:86594
AlmaLinux 8	dotnet-hostfxr-9.0 +7	9.0.21-1.el8_10	ALSA-2026:86170
AlmaLinux 8	dotnet-sdk-8.0 +3	8.0.132-2.el8_10	ALSA-2026:86594
AlmaLinux 8	dotnet-sdk-9.0 +5	9.0.122-1.el8_10	ALSA-2026:86170

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	dotnet10.0	10.0.113-1.el10_2	RLSA-2026:86195
Rocky Linux 10	dotnet8.0	8.0.132-1.el10_2	RLSA-2026:86168
Rocky Linux 10	dotnet9.0	9.0.122-1.el10_2	RLSA-2026:86172
Rocky Linux 9	dotnet10.0	10.0.113-1.el9_8	RLSA-2026:86193
Rocky Linux 9	dotnet8.0	8.0.132-1.el9_8	RLSA-2026:86169
Rocky Linux 9	dotnet9.0	9.0.122-1.el9_8	RLSA-2026:86171
Rocky Linux 8	dotnet10.0	10.0.113-1.el8_10	RLSA-2026:86192
Rocky Linux 8	dotnet8.0	8.0.132-2.el8_10	RLSA-2026:86594
Rocky Linux 8	dotnet9.0	9.0.122-1.el8_10	RLSA-2026:86170

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	dotnet10-runtime	10.0.13-r0	—
Alpine v3.24	dotnet8-runtime	8.0.32-r0	—
Alpine v3.24	dotnet9-runtime	9.0.21-r0	—
Alpine v3.23	dotnet10-runtime	10.0.13-r0	—
Alpine v3.23	dotnet8-runtime	8.0.32-r0	—
Alpine v3.23	dotnet9-runtime	9.0.21-r0	—
Alpine v3.22	dotnet8-runtime	8.0.32-r0	—
Alpine v3.22	dotnet9-runtime	9.0.21-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	dotnet +5	8.0.133-1.amzn2023.0.1	ALAS2023-2026-3367, ALAS2023-2026-3366, ALAS2023-2026-3248
Amazon Linux 2023	dotnet-host +8	8.0.33-1.amzn2023.0.1	ALAS2023-2026-3367, ALAS2023-2026-3366, ALAS2023-2026-3248
Amazon Linux 2023	dotnet-hostfxr-10.0 +7	10.0.14-1.amzn2023.0.1	ALAS2023-2026-3366
Amazon Linux 2023	dotnet-hostfxr-9.0 +7	9.0.21-1.amzn2023.0.1	ALAS2023-2026-3248
Amazon Linux 2023	dotnet-sdk-10.0 +4	10.0.114-1.amzn2023.0.1	ALAS2023-2026-3366
Amazon Linux 2023	dotnet-sdk-9.0 +4	9.0.122-1.amzn2023.0.1	ALAS2023-2026-3248

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	dotnet-host +8	10.0.13-1.0.1.el10_2	ELSA-2026-86195
Oracle Linux 10	dotnet-hostfxr-8.0 +7	8.0.32-1.0.1.el10_2	ELSA-2026-86168
Oracle Linux 10	dotnet-hostfxr-9.0 +7	9.0.21-1.0.1.el10_2	ELSA-2026-86172
Oracle Linux 10	dotnet-sdk-10.0 +4	10.0.113-1.0.1.el10_2	ELSA-2026-86195
Oracle Linux 10	dotnet-sdk-8.0 +3	8.0.132-1.0.1.el10_2	ELSA-2026-86168
Oracle Linux 10	dotnet-sdk-9.0 +5	9.0.122-1.0.1.el10_2	ELSA-2026-86172
Oracle Linux 9	dotnet-host +8	10.0.13-1.0.1.el9_8	ELSA-2026-86193
Oracle Linux 9	dotnet-hostfxr-8.0 +7	8.0.32-1.0.1.el9_8	ELSA-2026-86169
Oracle Linux 9	dotnet-hostfxr-9.0 +7	9.0.21-1.0.1.el9_8	ELSA-2026-86171
Oracle Linux 9	dotnet-sdk-10.0 +4	10.0.113-1.0.1.el9_8	ELSA-2026-86193
Oracle Linux 9	dotnet-sdk-8.0 +3	8.0.132-1.0.1.el9_8	ELSA-2026-86169
Oracle Linux 9	dotnet-sdk-9.0 +5	9.0.122-1.0.1.el9_8	ELSA-2026-86171
Oracle Linux 8	dotnet +5	10.0.114-1.0.2.el8_10	ELSA-2026-86192
Oracle Linux 8	dotnet-host +8	10.0.14-1.0.2.el8_10	ELSA-2026-86192
Oracle Linux 8	dotnet-hostfxr-8.0 +7	8.0.32-2.0.1.el8_10	ELSA-2026-86594
Oracle Linux 8	dotnet-hostfxr-9.0 +7	9.0.21-1.0.1.el8_10	ELSA-2026-86170
Oracle Linux 8	dotnet-sdk-8.0 +3	8.0.132-2.0.1.el8_10	ELSA-2026-86594
Oracle Linux 8	dotnet-sdk-9.0 +5	9.0.122-1.0.1.el8_10	ELSA-2026-86170

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	dotnet-bootstrap-8	8.0.134-r0	—
Wolfi rolling	dotnet-bootstrap-9	9.0.124-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 8.0.0, < 8.0.32	8.0.32	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 11.0.0-preview.1, < 11.0.0-rc.2	11.0.0-rc.2	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 10.0.0, < 10.0.13	10.0.13	GHSA-f4g7-52wc-p8x7
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 9.0.0, < 9.0.21	9.0.21	GHSA-f4g7-52wc-p8x7

Advisories 34

ALSA-2026:86192 Critical: .NET 10.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 6, 2026
ALSA-2026:86195 Critical: .NET 10.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 5, 2026
ALSA-2026:86193 Critical: .NET 10.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 5, 2026
WID-SEC-2026-3893 Microsoft Entwicklerwerkzeuge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
ELSA-2026-86192 Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
ALSA-2026:86594 Critical: .NET 8.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 2, 2026
ALAS2023-2026-3366 Important: dotnet10.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
ALAS2023-2026-3367 Important: dotnet8.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
ALSA-2026:86172 Critical: .NET 9.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 31, 2026
ALSA-2026:86168 Critical: .NET 8.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 31, 2026
ALSA-2026:86171 Critical: .NET 9.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 31, 2026
ALSA-2026:86169 Critical: .NET 8.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 31, 2026
ALSA-2026:86170 Critical: .NET 9.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 31, 2026
ALAS2023-2026-3248 Critical: dotnet9.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 30, 2026
USN-8942-1 dotnet8, dotnet10, dotnet11 vulnerabilities Ubuntu Security Notices (USN) · Oct 30, 2026
RLSA-2026:86193 Critical: .NET 10.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86171 Critical: .NET 9.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86195 Critical: .NET 10.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86170 Critical: .NET 9.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86172 Critical: .NET 9.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86192 Critical: .NET 10.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86594 Critical: .NET 8.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86168 Critical: .NET 8.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
RLSA-2026:86169 Critical: .NET 8.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
ELSA-2026-86594 Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
ELSA-2026-86168 Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
ELSA-2026-86170 Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
ELSA-2026-86195 Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
ELSA-2026-86172 Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
ELSA-2026-86193 Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
ELSA-2026-86169 Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
ELSA-2026-86171 Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
MSRC-CVE-2026-96236 ASP.NET Core Denial of Service Vulnerability Microsoft Security Response Center · Oct 15, 2026
NCSC-2026-0426 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · Oct 13, 2026

References

ASP.NET Core Denial of Service Vulnerability vendor-advisory patch

CNA	v3.1	7.5
EUVD	v3.1	7.5
OSV:GHSA	v3.1	7.5