CVE-2026-109468
published 2026-10-15CVE-2026-109468: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.65%
50.3th percentile
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_visual_studio_2022_version_17.14 | >= 17.14.0 < 17.14.42 | 17.14.42 |
| microsoft | microsoft_visual_studio_2026_version_18.10 | >= 18.10.0 < 18.10.4 | 18.10.4 |
| microsoft | system.formats.cbor | >= 10.0.0 < 10.0.13 | 10.0.13 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dotnet: ASP.NET Core: Denial of Service via unthrottled resource allocation
vendor_redhat·2026-10-15·CVSS 7.5
CVE-2026-109468 [HIGH] CWE-770 dotnet: ASP.NET Core: Denial of Service via unthrottled resource allocation
dotnet: ASP.NET Core: Denial of Service via unthrottled resource allocation
A flaw was found in ASP.NET Core. The application framework fails to enforce limits or throttling on resource allocation when handling network requests. An unauthenticated remote attacker could exploit this vulnerability to exhaust system resources, leading to a Denial of Service (DoS).
Package: dotnet8.0 (Red Hat Hardened Images) - Not affected
VulDB
Microsoft System-Formats-Cbor/Visual Studio allocation of resources
vuldb·2026-10-15·CVSS 7.5
CVE-2026-109468 [HIGH] Microsoft System-Formats-Cbor/Visual Studio allocation of resources
A vulnerability described as problematic has been identified in Microsoft System-Formats-Cbor and Visual Studio. Affected is an unknown function. The manipulation results in allocation of resources.
This vulnerability is identified as CVE-2026-109468. The attack can be executed remotely. There is not any exploit available.
Applying a patch is advised to resolve this issue.
GHSA
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
ghsa_unreviewed·2026-10-15
CVE-2026-109468 [HIGH] CWE-770 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
No detection rules found.
No public exploits indexed.
2026-10-15
Published