{"id":"CVE-2026-118748","kind":"vulnerability","aliases":["CVE-2026-118748"],"related":[],"title":"ASP.NET Core: unbounded resource allocation lets an attacker deny service","description":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"ASP.NET Core allocates resources without limits or throttling, so an unauthenticated attacker over the network can exhaust them. The result is denial of service for applications built on the framework.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":[".net","aspnet-core","runtime","web-api"],"not_affected_if":[],"how_to_check":"- Check the ASP.NET Core version in the project file or with `dotnet --list-runtimes`","fix":null,"status":"open","published_at":"2026-11-10T19:19:51+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","triaged_at":"2026-11-10T19:44:42+00:00","updated_at":"2026-11-10T19:44:42+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:44:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASP.NET Core: unbounded resource allocation lets an attacker deny service","impact":"low","summary":"ASP.NET Core allocates resources without limits or throttling, so an unauthenticated attacker over the network can exhaust them. The result is denial of service for applications built on the framework.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core",".net","web-api"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Service becomes unavailable to legitimate users over the network","analyst_note":"Find the Microsoft advisory and NVD entry for CVE-2026-118748 to confirm affected ASP.NET Core version ranges, the fixed versions, and whether a configuration enables the flaw.","how_to_check":"- Check the ASP.NET Core version in the project file or with `dotnet --list-runtimes`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any ASP.NET Core application reachable over the network may be exposed, since the description names an unauthorized network attacker. The sources do not state which versions, hosting setups or configurations are affected, so teams should confirm against the Microsoft advisory.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4496,"output_tokens":487,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory and NVD entry for CVE-2026-118748 to confirm affected ASP.NET Core version ranges, the fixed versions, and whether a configuration enables the flaw.","search":"'-118748':13A,16A '-2026':12A,15A 'alloc':5A,27B,55C 'allow':65C 'api':24B 'applic':50B 'asp.net':1A,25B,63C 'aspnet':19B 'aspnet-cor':18B 'attack':8A,36B,68C 'built':51B 'core':2A,20B,26B,64C 'cve':11A,14A 'deni':9A,70C 'denial':46B 'exhaust':41B 'framework':54B 'let':6A 'limit':30B,59C 'net':17B 'network':39B,74C 'resourc':4A,28B,57C 'result':44B 'runtim':21B 'servic':10A,48B,71C 'throttl':32B,61C 'unauthent':35B 'unauthor':67C 'unbound':3A 'web':23B 'web-api':22B 'without':29B,58C","nicknames":[],"mitigations":[],"who_affected":"Any ASP.NET Core application reachable over the network may be exposed, since the description names an unauthorized network attacker. The sources do not state which versions, hosting setups or configurations are affected, so teams should confirm against the Microsoft advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","high","net","runtime","webapi"],"campaign_type":null,"search_a":"'-118748':13A,16A '-2026':12A,15A 'alloc':5A 'asp.net':1A 'attack':8A 'core':2A 'cve':11A,14A 'deni':9A 'let':6A 'resourc':4A 'servic':10A 'unbound':3A","search_b":"'alloc':27B 'api':24B 'applic':50B 'asp.net':25B 'aspnet':19B 'aspnet-cor':18B 'attack':36B 'built':51B 'core':20B,26B 'denial':46B 'exhaust':41B 'framework':54B 'limit':30B 'net':17B 'network':39B 'resourc':28B 'result':44B 'runtim':21B 'servic':48B 'throttl':32B 'unauthent':35B 'web':23B 'web-api':22B 'without':29B","search_c":"'alloc':55C 'allow':65C 'asp.net':63C 'attack':68C 'core':64C 'deni':70C 'limit':59C 'network':74C 'resourc':57C 'servic':71C 'throttl':61C 'unauthor':67C 'without':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118748","severity":null,"published_at":"2026-11-10T19:19:51+00:00","modified_at":"2026-11-10T19:19:51+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","fetched_at":"2026-11-10T19:24:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}