Loading vulnerability…
ASP.NET Core HttpSys Resource Exhaustion Denial of Service
CVE-2026-114154 is a resource-exhaustion vulnerability in Microsoft.AspNetCore.Server.HttpSys affecting Windows-hosted ASP.NET Core applications on .NET 8, 9, and 10, as well as affected standalone HttpSys packages. During request initialization, RemoveContentLengthIfTransferEncodingContainsChunked() attempts to preserve Content-Length using a dictionary insertion under X-Content-Length. A crafted request containing chunked Transfer-Encoding, Content-Length, and an existing X-Content-Length header causes a duplicate-key exception. The exception handler in AsyncAcceptContext.IOCompleted subsequently accesses a native request context whose resources may already have been released, causing a secondary exception before an HTTP 400 response can be sent. This failure leaves request resources unreleased and prevents proper recycling of the asynchronous accept context, enabling an unauthenticated remote attacker to exhaust resources and deny service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust request and connection resources, disrupting availability of the affected ASP.NET Core application. The vulnerability has a CVSS v3.1 base score of 7.5, with high availability impact and no identified confidentiality or integrity impact. Exploitation requires neither authentication nor user interaction.
If you can’t patch tonight, do this now.
No temporary workaround is specified. Inventory deployed ASP.NET Core runtimes and standalone HttpSys package references, including runtimes embedded in self-contained applications, to identify deployments requiring updates.
Patch, then assume compromise.
Install the applicable patched ASP.NET Core runtime: 8.0.34, 9.0.23, or 10.0.15, or a later supported security release, and restart affected applications. Update standalone Microsoft.AspNetCore.Server.HttpSys package references to 2.3.14 or a later fixed version, then rebuild and redeploy applications, including framework-dependent deployments using that package. Rebuild and redeploy self-contained applications with a patched runtime because installing a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update standalone package references. The code fixes prevent duplicate header insertion and capture the native request identifier before request initialization can invalidate its context.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.