Microsoft ASP.NET Core Uncontrolled Resource Consumption Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in ASP.NET Core, specifically in versions 8.0, 9.0, and 10.0, as well as in .NET 8.0 and 10.0 across Windows, Linux, and Mac OS. This vulnerability allows an unauthorized attacker to cause uncontrolled resource consumption, leading to a denial-of-service condition over the network.

Impact

Exploitation of this vulnerability causes a significant denial-of-service condition, allowing an attacker to disrupt network services by overwhelming system resources.

Remediation

Users can download the security update for ASP.NET Core and .NET 10.0 from the official .NET website. For ASP.NET Core 9.0 and 8.0, the security update is also available on the .NET website. Visual Studio 2026 users can download the security update through the Visual Studio Downloads page.