{"id":"CVE-2026-118749","kind":"vulnerability","aliases":["CVE-2026-118749"],"related":[],"title":"ASP.NET Core: algorithmic inefficiency lets remote attackers cause denial of service","description":"Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"ASP.NET Core has an inefficient algorithm that an unauthenticated attacker can trigger over the network. The result is a denial of service, where the application slows down or stops responding.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspnet-core","dotnet","runtime","web-apps"],"not_affected_if":[],"how_to_check":"- Check the ASP.NET Core runtime version in the project's target framework and deployed runtime, for example `dotnet --list-runtimes`\n- Compare against the fixed versions once the vendor advisory is read; the sources here do not list them","fix":null,"status":"open","published_at":"2026-11-10T19:19:51+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","triaged_at":"2026-11-10T19:44:37+00:00","updated_at":"2026-11-10T19:44:37+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:44:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASP.NET Core: algorithmic inefficiency lets remote attackers cause denial of service","impact":"low","summary":"ASP.NET Core has an inefficient algorithm that an unauthenticated attacker can trigger over the network. The result is a denial of service, where the application slows down or stops responding.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","web-apps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker makes the service unresponsive, causing denial of service","analyst_note":"Find the Microsoft advisory for CVE-2026-118749 to get affected and fixed ASP.NET Core versions and which request paths trigger the inefficiency.","how_to_check":"- Check the ASP.NET Core runtime version in the project's target framework and deployed runtime, for example `dotnet --list-runtimes`\n- Compare against the fixed versions once the vendor advisory is read; the sources here do not list them\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4496,"output_tokens":456,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory for CVE-2026-118749 to get affected and fixed ASP.NET Core versions and which request paths trigger the inefficiency.","search":"'-118749':14A,17A '-2026':13A,16A 'algorithm':3A,31B,57C 'allow':62C 'app':25B 'applic':50B 'asp.net':1A,26B,60C 'aspnet':19B 'aspnet-cor':18B 'attack':7A,35B,65C 'caus':8A 'complex':58C 'core':2A,20B,27B,61C 'cve':12A,15A 'deni':67C 'denial':9A,45B 'dotnet':21B 'ineffici':4A,30B,56C 'let':5A 'network':40B,71C 'remot':6A 'respond':55B 'result':42B 'runtim':22B 'servic':11A,47B,68C 'slow':51B 'stop':54B 'trigger':37B 'unauthent':34B 'unauthor':64C 'web':24B 'web-app':23B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","dotnet","high","runtime","webapps"],"campaign_type":null,"search_a":"'-118749':14A,17A '-2026':13A,16A 'algorithm':3A 'asp.net':1A 'attack':7A 'caus':8A 'core':2A 'cve':12A,15A 'denial':9A 'ineffici':4A 'let':5A 'remot':6A 'servic':11A","search_b":"'algorithm':31B 'app':25B 'applic':50B 'asp.net':26B 'aspnet':19B 'aspnet-cor':18B 'attack':35B 'core':20B,27B 'denial':45B 'dotnet':21B 'ineffici':30B 'network':40B 'respond':55B 'result':42B 'runtim':22B 'servic':47B 'slow':51B 'stop':54B 'trigger':37B 'unauthent':34B 'web':24B 'web-app':23B","search_c":"'algorithm':57C 'allow':62C 'asp.net':60C 'attack':65C 'complex':58C 'core':61C 'deni':67C 'ineffici':56C 'network':71C 'servic':68C 'unauthor':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118749","severity":null,"published_at":"2026-11-10T19:19:51+00:00","modified_at":"2026-11-10T19:19:51+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","fetched_at":"2026-11-10T19:24:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}