{"id":"CVE-2026-114147","kind":"vulnerability","aliases":["CVE-2026-114147"],"related":[],"title":"ASP.NET Core: memory not released after use lets remote attackers exhaust server memory","description":"Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"ASP.NET Core leaks memory after its useful lifetime ends, per the NVD description. An unauthenticated attacker over the network can exhaust memory and deny service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspnet-core","dotnet","runtime","self-hosted"],"not_affected_if":[],"how_to_check":"- Check the installed ASP.NET Core runtime version with `dotnet --list-runtimes`\n- Confirm whether the affected version ranges are listed in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114147)","fix":null,"status":"open","published_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:44:59+00:00","updated_at":"2026-11-10T19:44:59+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:44:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASP.NET Core: memory not released after use lets remote attackers exhaust server memory","impact":"low","summary":"ASP.NET Core leaks memory after its useful lifetime ends, per the NVD description. An unauthenticated attacker over the network can exhaust memory and deny service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker exhausts server memory, causing denial of service","analyst_note":"Find affected version ranges and fixed versions for CVE-2026-114147 from the vendor (Microsoft) advisory; NVD text alone gives no versions.","how_to_check":"- Check the installed ASP.NET Core runtime version with `dotnet --list-runtimes`\n- Confirm whether the affected version ranges are listed in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114147)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4496,"output_tokens":452,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find affected version ranges and fixed versions for CVE-2026-114147 from the vendor (Microsoft) advisory; NVD text alone gives no versions.","search":"'-114147':16A,19A '-2026':15A,18A 'allow':63C 'asp.net':1A,28B,61C 'aspnet':21B 'aspnet-cor':20B 'attack':10A,43B,66C 'core':2A,22B,29B,62C 'cve':14A,17A 'deni':51B,68C 'descript':40B 'dotnet':23B 'effect':58C 'end':36B 'exhaust':11A,48B 'host':27B 'leak':30B 'let':8A 'lifetim':35B,59C 'memori':3A,13A,31B,49B,56C 'miss':53C 'network':46B,72C 'nvd':39B 'per':37B 'releas':5A,54C 'remot':9A 'runtim':24B 'self':26B 'self-host':25B 'server':12A 'servic':52B,69C 'unauthent':42B 'unauthor':65C 'use':7A,34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","dotnet","high","runtime","selfhosted"],"campaign_type":null,"search_a":"'-114147':16A,19A '-2026':15A,18A 'asp.net':1A 'attack':10A 'core':2A 'cve':14A,17A 'exhaust':11A 'let':8A 'memori':3A,13A 'releas':5A 'remot':9A 'server':12A 'use':7A","search_b":"'asp.net':28B 'aspnet':21B 'aspnet-cor':20B 'attack':43B 'core':22B,29B 'deni':51B 'descript':40B 'dotnet':23B 'end':36B 'exhaust':48B 'host':27B 'leak':30B 'lifetim':35B 'memori':31B,49B 'network':46B 'nvd':39B 'per':37B 'runtim':24B 'self':26B 'self-host':25B 'servic':52B 'unauthent':42B 'use':34B","search_c":"'allow':63C 'asp.net':61C 'attack':66C 'core':62C 'deni':68C 'effect':58C 'lifetim':59C 'memori':56C 'miss':53C 'network':72C 'releas':54C 'servic':69C 'unauthor':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114147","severity":null,"published_at":"2026-11-10T19:19:07+00:00","modified_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}