High 7.5

ASP.NET Coreに、認証なしでサービスを停止させられる脆弱性

CVE-2026-114149 First seen on SecPulse 03:20

Summary

ASP.NET Coreに、リソースを制御できない問題があり、認証のない攻撃者がネットワーク越しにサービスを停止させられる脆弱性が見つかりました。CVSSは7.5です。影響を受けるのは、.NET 10.0はバージョン10.0.15より前、.NET 11.0はプレビュー版から11.0.0より前のものです。修正版は、.NET 10.0が10.0.15、.NET 11.0が11.0.0なので、適用してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Microsoft	Microsoft.NET 10.0 installed on Linux	≥ 10.0.0, < 10.0.15→ 10.0.15	10.0.15
Microsoft	Microsoft.NET 10.0 installed on Mac OS	≥ 10.0.0, < 10.0.15→ 10.0.15	10.0.15
Microsoft	Microsoft.NET 10.0 installed on Windows	≥ 10.0.0, < 10.0.15→ 10.0.15	10.0.15
Microsoft	Microsoft.NET 11.0 installed on Linux	≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0	11.0.0
Microsoft	Microsoft.NET 11.0 installed on Mac OS	≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0	11.0.0
Microsoft	Microsoft.NET 11.0 installed on Windows	≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0	11.0.0
Microsoft	Microsoft.NET 8.0 installed on Linux	≥ 8.0.0, < 8.0.34→ 8.0.34	8.0.34
Microsoft	Microsoft.NET 8.0 installed on Mac OS	≥ 8.0.0, < 8.0.34→ 8.0.34	8.0.34
Microsoft	Microsoft.NET 8.0 installed on Windows	≥ 8.0.0, < 8.0.34→ 8.0.34	8.0.34
Microsoft	Microsoft.NET 9.0 installed on Linux	≥ 9.0.0, < 9.0.23→ 9.0.23	9.0.23
Microsoft	Microsoft.NET 9.0 installed on Mac OS	≥ 9.0.0, < 9.0.23→ 9.0.23	9.0.23
Microsoft	Microsoft.NET 9.0 installed on Windows	≥ 9.0.0, < 9.0.23→ 9.0.23	9.0.23
Microsoft	MicrosoftMicrosoft Visual Studio 2022 version 17.14	≥ 17.14.0, < 17.14.45→ 17.14.45	17.14.45
Microsoft	MicrosoftMicrosoft Visual Studio 2026 version 18.11	≥ 18.11.0, < 18.11.4→ 18.11.4	18.11.4
Microsoft	MicrosoftMicrosoft Visual Studio 2026 version 18.12	< 18.12.0→ 18.12.0	18.12.0
Microsoft	MicrosoftMicrosoft.AspNetCore.WebUtilities	≥ 2.3.12, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.linux-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.osx-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.osx-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.win-arm64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.win-x64	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.App.Runtime.win-x86	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0
NuGet	NuGetMicrosoft.AspNetCore.WebUtilities	≥ 11.0.0-preview.1.26104.118, < 11.0.0→ 11.0.0	11.0.0

Original description The description as published by the source.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Multipart form processing can bypass the configured header-count limit and consume excessive resources.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511

CVSS Details

Version: 3.1
Severity: High
Score: 7.5 (base score)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Weakness: CWE-770

Affected Platforms

Platforms: Windows, Linux, macOS
Architectures: All

Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 8.0 - affected runtime packages

Package	Affected version	Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm	>= 8.0.0-preview.1.23112.2, <= 8.0.33	8.0.34
Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 8.0.0-preview.1.23112.2, <= 8.0.33	8.0.34
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 8.0.0-preview.1.23112.2, <= 8.0.33	8.0.34
[Microsoft.AspNetCore.…

Source: Microsoft Security Response Center Blog NVD GitHub Advisory