MICROSOFT.ASPNETCORE.SERVER.HTTPSYS · GHSA-49q5-vjx7-5gwr · Package
NO FIX YET
Microsoft.AspNetCore.Server.HttpSys has an uncontrolled resource consumption flaw that lets an unauthorized network attacker exhaust resources and deny service. This advisory is withdrawn as a duplicate of GHSA-3893-7fxc-qvff, so that advisory is the one to track.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that host ASP.NET Core with the HttpSys server on Windows and accept network traffic are the ones exposed. Apps behind a different server such as Kestrel, or not reachable from the network, are less likely affected. Because the advisory is withdrawn, the duplicate GHSA-3893-7fxc-qvff carries the working data.
Not affected if kestrel-server, not-network-exposed
Who cares asp.net-core, httpsys, nuget, windows
dotnet list packageNo fix yet, per the sources.
This advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references.
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.