CVE-2026-70183
HighCVSS 7.5Summary
A race condition in ASP.NET Core caused by improper synchronization of a shared resource allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An attacker with valid credentials could exploit the resource race to gain higher privileges within the application.
Recommendation
Update ASP.NET Core to a patched version and review application code for safe synchronization of shared resources.
Other vulnerabilities in ASP.NET Core
See all- CVE-2017-11879High
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.
- CVE-2017-0249High
An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.
- CVE-2026-88092Critical
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-70188Critical
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-40372Critical
A vulnerability in ASP.NET Core due to improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.
- CVE-2021-31957Medium
ASP.NET Core has a Denial of Service (DoS) vulnerability that could lead to service overload and unavailability.
- CVE-2020-1161High
Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.
- CVE-2026-96236High
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVE-2026-96233High
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVE-2026-96230High
A cross-site scripting (XSS) vulnerability in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS