Loading vulnerability…
ASP.NET Core Response Buffering Information Disclosure
CVE-2026-114150 is an uninitialized-resource vulnerability in Microsoft ASP.NET Core response-body buffering that can expose residual data from previously processed HTTP transactions. Reused pooled buffers can retain unwritten tail memory, and insufficient enforcement of the actual written length allows downstream consumers, including HTTP logging, to access those stale bytes. The affected infrastructure includes ResponseBufferingStream and response-buffering functionality used by HTTP logging and output-caching middleware. Affected releases include .NET 11.0 previews beginning with 11.0.0-preview.1 and preceding 11.0.0 general availability; Visual Studio 2026 versions before 18.12.0 are also identified as affected. The vulnerability permits unauthenticated network-based information disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive response-body data belonging to unrelated requests, including through HTTP logs or other response-buffer consumers. The confidentiality impact is rated High, with no assessed integrity or availability impact. The CVSS v3.1 base score is 5.9, reflecting network access, high attack complexity, no required privileges, and no user interaction. Microsoft reported no exploitation at initial publication and assessed exploitation as less likely.
If you can’t patch tonight, do this now.
Disabling HTTP response-body logging by excluding HttpLoggingFields.ResponseBody is a proposed interim measure for the logging disclosure path. It is not established as a complete workaround for other response-buffer consumers and should not replace patching. Buffer-handling code should expose only the bytes actually written, clear buffers before reuse, and reset byte-count state.
Patch, then assume compromise.
Upgrade affected ASP.NET Core runtimes and independently referenced affected packages to version 11.0.0 or later, then restart applications. Rebuild and redeploy self-contained applications to replace their embedded runtimes; updating the machine-wide runtime does not repair those deployments. An SDK update alone does not update independent application package references. Replace preview-based container deployments with images containing the fixed runtime. Update affected Visual Studio 2026 installations to version 18.12.0 or later. For Red Hat deployments, apply the applicable .NET 11.0 security updates, including RHSA-2026:99054 for RHEL 8 and RHSA-2026:99137 for RHEL 10.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.