PatchaPalooza

CVE-2026-118750: ASP.NET Core Denial of Service Vulnerability

CVE-2026-118750 is a denial of service vulnerability in ASP.NET Core, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 1 product in 1 product family (Other).

Key facts

CVE ID
CVE-2026-118750
Severity
High CVSS 7.5
Microsoft severity
Important
Impact
Denial of Service
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-770
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
November 2026 Patch Tuesday
Product families
Other

CVSS score and vector

Microsoft scores CVE-2026-118750 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products (1)

Other

ProductSecurity updateTypeFixed buildRestart
Microsoft.AspNetCore.WebUtilitiesRelease NotesSecurity Update2.3.14

NIST NVD data

NVD status
Awaiting Analysis
NVD CVSS
7.5 (HIGH)
NVD weakness
CWE-770
Published to NVD
NVD last modified

References

Acknowledgments

  • NavSec4

Revision history

VersionDateDescription
1.0Information published.
1.1Updated the products listed in the Security Updates table. This is an informational change only.

Sources