CVE-2026-40372

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.

An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.

ASP.NET Core has a Denial of Service (DoS) vulnerability that could lead to service overload and unavailability.

Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

ASP.NET Core has an authentication bypass vulnerability due to assumed-immutable data. This allows an authorized attacker to elevate privileges over a network.

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Resource allocation without limits in ASP.NET Core allows an unauthorized attacker to perform a DoS attack over the network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.