PatchaPalooza

CVE-2026-114147: ASP.NET Core Denial of Service Vulnerability

CVE-2026-114147 is a denial of service vulnerability in ASP.NET Core, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday, delivered through 3 security updates (KB5135243, KB5135242, KB5135241). It affects 28 products in 2 product families (Other, Developer Tools).

Key facts

CVE ID
CVE-2026-114147
Severity
High CVSS 7.5
Microsoft severity
Important
Impact
Denial of Service
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
November 2026 Patch Tuesday
Product families
Other, Developer Tools

CVSS score and vector

Microsoft scores CVE-2026-114147 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products (28)

Other

ProductSecurity updateTypeFixed buildRestart
Microsoft.AspNetCore.SignalR.StackExchangeRedisRelease NotesSecurity Update10.0.15
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 8.0 installed on WindowsKB5135243Security Update8.0.34
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 8.0 installed on LinuxKB5135243Security Update8.0.34
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 8.0 installed on Mac OSKB5135243Security Update8.0.34
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 9.0 installed on WindowsKB5135242Security Update9.0.23
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 9.0 installed on LinuxKB5135242Security Update9.0.23
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 9.0 installed on Mac OSKB5135242Security Update9.0.23
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 10.0 installed on Windows
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 10.0 installed on Linux
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 10.0 installed on Mac OS
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 11.0 installed on WindowsRelease NotesSecurity Update11.0.0
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 11.0 installed on LinuxRelease NotesSecurity Update11.0.0
Microsoft.AspNetCore.SignalR.StackExchangeRedis on .NET 11.0 installed on Mac OSRelease NotesSecurity Update11.0.0

Developer Tools

ProductSecurity updateTypeFixed buildRestart
.NET 8.0 installed on WindowsKB5135243Security Update8.0.34
.NET 8.0 installed on LinuxKB5135243Security Update8.0.34
.NET 8.0 installed on Mac OSKB5135243Security Update8.0.34
.NET 9.0 installed on WindowsKB5135242Security Update9.0.23
.NET 9.0 installed on LinuxKB5135242Security Update9.0.23
.NET 9.0 installed on Mac OSKB5135242Security Update9.0.23
.NET 10.0 installed on WindowsKB5135241Security Update10.0.15
.NET 10.0 installed on LinuxKB5135241Security Update10.0.15
.NET 10.0 installed on Mac OSKB5135241Security Update10.0.15
.NET 11.0 installed on WindowsRelease NotesSecurity Update11.0.0
.NET 11.0 installed on LinuxRelease NotesSecurity Update11.0.0
.NET 11.0 installed on Mac OSRelease NotesSecurity Update11.0.0
Microsoft Visual Studio 2022 version 17.14Release NotesSecurity Update17.14.45
Microsoft Visual Studio 2026 version 18.11
Microsoft Visual Studio 2026 version 18.12

Security updates (3)

Acknowledgments

Revision history

VersionDateDescription
1.0Information published.

Sources