Microsoft Patches Remote Denial-of-Service Vulnerabilities in .NET and ASP.NET Core
Patch & Detection Intelligence · 3 sources · Updated 5mo ago · First seen Mar 11, 2026
Microsoft published security advisories for two Important remote denial-of-service (DoS) vulnerabilities affecting .NET and ASP.NET Core: CVE-2026-26127 and CVE-2026-26130. Both issues are scored CVSS 3.1 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network-reachable exploitation with low complexity, no privileges, and no user interaction, resulting in high availability impact.
CVE-2026-26127 is described as a .NET DoS condition associated with CWE-125 (Out-of-bounds Read), while CVE-2026-26130 is an ASP.NET Core DoS issue associated with CWE-770 (Allocation of Resources Without Limits or Throttling). Organizations running internet-exposed or high-availability services on these frameworks should prioritize applying Microsoft’s updates and review service-level protections (e.g., request throttling and resource limits) where applicable to reduce DoS risk.
