{"id":"CVE-2026-114149","kind":"vulnerability","aliases":["CVE-2026-114149"],"related":[],"title":"ASP.NET Core: uncontrolled resource use lets attackers crash the service","description":"Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"ASP.NET Core, Microsoft's web framework for .NET, consumes resources without limit when handling certain requests. An unauthenticated attacker over the network can exhaust those resources and deny service to the application.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspnet-core","dotnet","runtime","web-api"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:08+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:44:59+00:00","updated_at":"2026-11-10T19:44:59+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:44:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ASP.NET Core: uncontrolled resource use lets attackers crash the service","impact":"low","summary":"ASP.NET Core, Microsoft's web framework for .NET, consumes resources without limit when handling certain requests. An unauthenticated attacker over the network can exhaust those resources and deny service to the application.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","web-api"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker makes the application unavailable through resource exhaustion","analyst_note":"Check the NVD entry and Microsoft's security advisory for affected ASP.NET Core versions, the fixed versions and the request type that triggers the exhaustion.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4494,"output_tokens":395,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the NVD entry and Microsoft's security advisory for affected ASP.NET Core versions, the fixed versions and the request type that triggers the exhaustion.","search":"'-114149':13A,16A '-2026':12A,15A 'allow':63C 'api':24B 'applic':56B 'asp.net':1A,25B,61C 'aspnet':18B 'aspnet-cor':17B 'attack':7A,43B,66C 'certain':39B 'consum':33B 'consumpt':59C 'core':2A,19B,26B,62C 'crash':8A 'cve':11A,14A 'deni':52B,68C 'dotnet':20B 'exhaust':48B 'framework':30B 'handl':38B 'let':6A 'limit':36B 'microsoft':27B 'net':32B 'network':46B,72C 'request':40B 'resourc':4A,34B,50B,58C 'runtim':21B 'servic':10A,53B,69C 'unauthent':42B 'unauthor':65C 'uncontrol':3A,57C 'use':5A 'web':23B,29B 'web-api':22B 'without':35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","dotnet","high","runtime","webapi"],"campaign_type":null,"search_a":"'-114149':13A,16A '-2026':12A,15A 'asp.net':1A 'attack':7A 'core':2A 'crash':8A 'cve':11A,14A 'let':6A 'resourc':4A 'servic':10A 'uncontrol':3A 'use':5A","search_b":"'api':24B 'applic':56B 'asp.net':25B 'aspnet':18B 'aspnet-cor':17B 'attack':43B 'certain':39B 'consum':33B 'core':19B,26B 'deni':52B 'dotnet':20B 'exhaust':48B 'framework':30B 'handl':38B 'limit':36B 'microsoft':27B 'net':32B 'network':46B 'request':40B 'resourc':34B,50B 'runtim':21B 'servic':53B 'unauthent':42B 'web':23B,29B 'web-api':22B 'without':35B","search_c":"'allow':63C 'asp.net':61C 'attack':66C 'consumpt':59C 'core':62C 'deni':68C 'network':72C 'resourc':58C 'servic':69C 'unauthor':65C 'uncontrol':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114149","severity":null,"published_at":"2026-11-10T19:19:08+00:00","modified_at":"2026-11-10T19:19:08+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}