CVE-2026-70159
HighCVSS 7.5Summary
A vulnerability in ASP.NET Core involves allocation of resources without limits or throttling. An unauthenticated attacker can cause a denial of service over the network.
Risk Assessment
A network-based attacker can exhaust ASP.NET Core application resources, making it unavailable to legitimate users. This may disrupt critical web services.
Recommendation
Update ASP.NET Core to a patched version and implement request rate limiting and resource limits at the server level.
Other vulnerabilities in ASP.NET Core
See all- CVE-2017-11879High
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.
- CVE-2017-0249High
An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.
- CVE-2026-88092Critical
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-70188Critical
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-40372Critical
A vulnerability in ASP.NET Core due to improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.
- CVE-2021-31957Medium
ASP.NET Core has a Denial of Service (DoS) vulnerability that could lead to service overload and unavailability.
- CVE-2020-1161High
Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.
- CVE-2026-96236High
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVE-2026-96233High
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVE-2026-96230High
A cross-site scripting (XSS) vulnerability in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS