{"id":"CVE-2026-109478","kind":"vulnerability","aliases":["CVE-2026-109478"],"related":[],"title":"ASP.NET Core: inefficient algorithm lets unauthenticated network attacker cause denial of service","description":"Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"ASP.NET Core has an algorithmic complexity flaw that makes certain inputs take disproportionately long to process. An unauthenticated attacker over the network can use this to exhaust server resources and deny service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ASP.NET Core","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["aspnet-core","dotnet","runtime","web-services"],"not_affected_if":[],"how_to_check":"- Check the ASP.NET Core runtime version in use with `dotnet --list-runtimes`\n- Compare against the fixed versions listed in the product data (unknown from the sources given)","fix":null,"status":"open","published_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","triaged_at":"2026-11-10T19:47:24+00:00","updated_at":"2026-11-10T19:47:24+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:47:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ASP.NET Core: inefficient algorithm lets unauthenticated network attacker cause denial of service","impact":"low","summary":"ASP.NET Core has an algorithmic complexity flaw that makes certain inputs take disproportionately long to process. An unauthenticated attacker over the network can use this to exhaust server resources and deny service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","web-services"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Server becomes unresponsive to legitimate requests from remote clients","analyst_note":"Confirm affected and fixed ASP.NET Core versions and which request paths are vulnerable from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109478.","how_to_check":"- Check the ASP.NET Core runtime version in use with `dotnet --list-runtimes`\n- Compare against the fixed versions listed in the product data (unknown from the sources given)","plain_action":"","product_name":"ASP.NET Core","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4496,"output_tokens":488,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected and fixed ASP.NET Core versions and which request paths are vulnerable from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109478.","search":"'-109478':15A,18A '-2026':14A,17A 'algorithm':4A,33B,62C 'allow':67C 'asp.net':1A,19A,29B,65C 'aspnet':22B 'aspnet-cor':21B 'attack':8A,47B,70C 'caus':9A 'certain':38B 'complex':34B,63C 'core':2A,20A,23B,30B,66C 'cve':13A,16A 'deni':59B,72C 'denial':10A 'disproportion':41B 'dotnet':24B 'exhaust':55B 'flaw':35B 'ineffici':3A,61C 'input':39B 'let':5A 'long':42B 'make':37B 'network':7A,50B,76C 'process':44B 'resourc':57B 'runtim':25B 'server':56B 'servic':12A,28B,60B,73C 'take':40B 'unauthent':6A,46B 'unauthor':69C 'use':52B 'web':27B 'web-servic':26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["aspnetcore","core"],"ptokens":["asp","core","net"],"labels":["aspnetcore","dotnet","high","runtime","webservices"],"campaign_type":null,"search_a":"'-109478':15A,18A '-2026':14A,17A 'algorithm':4A 'asp.net':1A,19A 'attack':8A 'caus':9A 'core':2A,20A 'cve':13A,16A 'denial':10A 'ineffici':3A 'let':5A 'network':7A 'servic':12A 'unauthent':6A","search_b":"'algorithm':33B 'asp.net':29B 'aspnet':22B 'aspnet-cor':21B 'attack':47B 'certain':38B 'complex':34B 'core':23B,30B 'deni':59B 'disproportion':41B 'dotnet':24B 'exhaust':55B 'flaw':35B 'input':39B 'long':42B 'make':37B 'network':50B 'process':44B 'resourc':57B 'runtim':25B 'server':56B 'servic':28B,60B 'take':40B 'unauthent':46B 'use':52B 'web':27B 'web-servic':26B","search_c":"'algorithm':62C 'allow':67C 'asp.net':65C 'attack':70C 'complex':63C 'core':66C 'deni':72C 'ineffici':61C 'network':76C 'servic':73C 'unauthor':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109478","severity":null,"published_at":"2026-11-10T19:18:17+00:00","modified_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","fetched_at":"2026-11-10T19:24:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}