Skip to content
Sign in Sign up
JA EN FR
SecPulse
High 7.5

ASP.NET Coreの脆弱性で未認証の攻撃者からサービス停止に陥るおそれ

CVE-2026-118750 First seen on SecPulse

Summary

ASP.NET Coreに、リソースの上限や制限が無いことに起因するサービス拒否(DoS)の脆弱性が見つかりました。認証のない攻撃者がネットワーク越しにサービスを停止させるおそれがあり、CVSSは7.5です。影響するMicrosoft.AspNetCore.WebUtilitiesは2.3.12以上2.3.14未満で、2.3.14が修正版なので、速やかに更新してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

ASP.NET Coreに、リソースの上限や制限が無いことに起因するサービス拒否(DoS)の脆弱性が見つかりました。認証のない攻撃者がネットワーク越しにサービスを停止させるおそれがあり、CVSSは7.5です。影響するMicrosoft.AspNetCore.WebUtilitiesは2.3.12以上2.3.14未満で、2.3.14が修正版なので、速やかに更新してください。

Affected packages

PackageAffected → Fixed
MicrosoftMicrosoft.AspNetCore.WebUtilities
≥ 2.3.12, < 2.3.14→ 2.3.14
NuGetMicrosoft.AspNetCore.WebUtilities
≥ 2.3.0, < 2.3.14→ 2.3.14
Original description The description as published by the source.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

FileBufferingReadStream buffer allocation can allow unauthenticated multipart-form requests to exhaust memory.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/512

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 7.5 (base score)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
  • Weakness: CWE-770

Affected Platforms

  • Platforms: Any supported OS
  • Architectures: All

Affected Packages

The table lists the affected package range and the fixed NuGet version.

ASP.NET Core 2.3 - standalone packages

Package Affected version Patched version
Microsoft.AspNetCore.WebUtilities >= 2.3.0, <= 2.3.13 2.3.14

Advisory FAQ

How do I know if I am affected?

Check the application's Microsoft.AspNetCore.WebUtilities package reference against the affected range above, including transitive dependencies brought in by Microsoft.AspNetCore.Http. Use dotnet list package --include-transitive to inspect resolved dependencies.

How do I fix the issue?

Update each applicable package reference to its patched version listed above, then rebuild and redeploy the…

Source: Microsoft Security Response Center Blog NVD GitHub Advisory

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details