Microsoft Fixes ASP.NET Core Flaw Allowing Unauthenticated Denial of Service

Microsoft released a fix for CVE-2026-114154, an ASP.NET Core denial-of-service vulnerability that allows an unauthenticated attacker to trigger uncontrolled resource consumption over a network. Microsoft rates the flaw Important, with a CVSS v3.1 base score of 7.5. Exploitation requires low attack complexity and no user interaction, with high availability impact but no identified confidentiality or integrity impact. At its November 10 disclosure, Microsoft reported no public disclosure or observed exploitation and assessed exploitation as less likely. Microsoft advisory

Organizations running ASP.NET Core should identify affected deployments and apply Microsoft's applicable security updates, prioritizing internet-facing services. Resource exhaustion can degrade performance or make services unavailable. MITRE's CWE-401 guidance describes one such mechanism—failure to release memory after use—which can cause instability, crashes, or hangs; however, the supplied Microsoft summary does not establish that this vulnerability specifically involves a memory leak. Memory and service-availability monitoring can support detection but should not replace patching. MITRE guidance