Skip to content
Sign in Sign up
JA EN FR
SecPulse
High 7.5

ASP.NET Coreに未認証の攻撃者からサービスを停止させられる脆弱性

CVE-2026-118749 First seen on SecPulse

Summary

ASP.NET Coreの処理で計算量が過大になる問題があり、認証なしの攻撃者がネットワーク越しにサービスを停止させられるおそれがあります。影響を受けるのは.NET 11.0の各版（Linux・Mac OS・Windows）、Microsoft Visual Studio 2026 version 18.12より前、Microsoft.Extensions.Validation 11.0.0より前です。修正版は.NET 11.0.0、Visual Studio 2026 version 18.12.0、Microsoft.Extensions.Validation 11.0.0で、該当する環境は早めに修正版へ更新してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

ASP.NET Coreの処理で計算量が過大になる問題があり、認証なしの攻撃者がネットワーク越しにサービスを停止させられるおそれがあります。影響を受けるのは.NET 11.0の各版（Linux・Mac OS・Windows）、Microsoft Visual Studio 2026 version 18.12より前、Microsoft.Extensions.Validation 11.0.0より前です。修正版は.NET 11.0.0、Visual Studio 2026 version 18.12.0、Microsoft.Extensions.Validation 11.0.0で、該当する環境は早めに修正版へ更新してください。

Affected packages

PackageAffected → Fixed
Microsoft.NET 11.0 installed on Linux
≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0
Microsoft.NET 11.0 installed on Mac OS
≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0
Microsoft.NET 11.0 installed on Windows
≥ 11.0.0-preview.1, < 11.0.0→ 11.0.0
MicrosoftMicrosoft Visual Studio 2026 version 18.12
< 18.12.0→ 18.12.0
MicrosoftMicrosoft.Extensions.Validation
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-x64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.linux-x64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.osx-arm64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.osx-x64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.win-arm64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.win-x64
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.AspNetCore.App.Runtime.win-x86
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
NuGetMicrosoft.Extensions.Validation
≥ 11.0.0-rc.1.26425.128, < 11.0.0→ 11.0.0
Original description The description as published by the source.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/505

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 7.5 (base score)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
  • Weakness: CWE-407

Affected Platforms

  • Platforms: Windows, Linux, macOS
  • Architectures: All

Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

.NET 11.0 - affected runtime packages

Package Affected version Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 11.0.0
Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 11.0.0
[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNet…

Source: Microsoft Security Response Center Blog NVD GitHub Advisory

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details