CVE-2026-45646

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.

An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.

A vulnerability in ASP.NET Core due to improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.

Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.

ASP.NET Core has an authentication bypass vulnerability due to assumed-immutable data. This allows an authorized attacker to elevate privileges over a network.

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Resource allocation without limits in ASP.NET Core allows an unauthorized attacker to perform a DoS attack over the network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

In ASP.NET Core, uncontrolled resource consumption allows an unauthorized attacker to perform a denial of service attack over a network.

A vulnerability in ASP.NET Core causes an infinite loop, which can be exploited by an unauthorized attacker to perform a Denial of Service (DoS) attack over the network.