{"id":"GHSA-49q5-vjx7-5gwr","kind":"vulnerability","aliases":["GHSA-49q5-vjx7-5gwr"],"related":[],"title":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references.\n\n## Original Description\nUncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"Microsoft.AspNetCore.Server.HttpSys has an uncontrolled resource consumption flaw that lets an unauthorized network attacker exhaust resources and deny service. This advisory is withdrawn as a duplicate of GHSA-3893-7fxc-qvff, so that advisory is the one to track.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft.AspNetCore.Server.HttpSys","fixed":[],"affected":"= 2.3.10","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["asp.net-core","cwe-401","httpsys","nuget","package","windows"],"not_affected_if":["kestrel-server","not-network-exposed"],"how_to_check":"- Check the ASP.NET Core HttpSys package version in the project file or `dotnet list package`\n- Confirm whether the app is hosted with HttpSys on Windows\n- Check the GHSA-3893-7fxc-qvff advisory for the affected and fixed ranges","fix":null,"status":"withdrawn","published_at":"2026-11-10T21:32:51+00:00","first_seen_at":"2026-11-10T22:12:11+00:00","triaged_at":"2026-11-10T22:13:53+00:00","updated_at":"2026-11-10T22:13:53+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T22:13:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASP.NET Core HttpSys: unauthenticated network attacker can cause denial of service","impact":"low","summary":"Microsoft.AspNetCore.Server.HttpSys has an uncontrolled resource consumption flaw that lets an unauthorized network attacker exhaust resources and deny service. This advisory is withdrawn as a duplicate of GHSA-3893-7fxc-qvff, so that advisory is the one to track.","audience":"businesses","category":"package","nicknames":[],"who_cares":["asp.net-core","httpsys","windows","nuget"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker exhausts server resources and takes the service down","analyst_note":"Withdrawn duplicate; confirm affected and fixed versions from GHSA-3893-7fxc-qvff before relying on this entry.","how_to_check":"- Check the ASP.NET Core HttpSys package version in the project file or `dotnet list package`\n- Confirm whether the app is hosted with HttpSys on Windows\n- Check the GHSA-3893-7fxc-qvff advisory for the affected and fixed ranges","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["kestrel-server","not-network-exposed"],"who_is_affected":"Applications that host ASP.NET Core with the HttpSys server on Windows and accept network traffic are the ones exposed. Apps behind a different server such as Kestrel, or not reachable from the network, are less likely affected. Because the advisory is withdrawn, the duplicate GHSA-3893-7fxc-qvff carries the working data.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000784,"input_tokens":4641,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114154':8A '-2026':7A '-3893':61B,88C '-401':29B '-7':62B,89C '49q5':17A,22A '5gwr':19A,24A 'advisori':2A,5A,53B,68B,75C,77C 'allow':109C 'asp.net':9A,26B,107C 'attack':46B,112C 'consumpt':39B,105C 'core':10A,27B,108C 'cve':6A 'cwe':28B 'deni':50B,114C 'denial':11A 'descript':102C 'duplic':1A,58B,74C,85C 'exhaust':47B 'extern':99C 'flaw':40B 'fxc':64B,91C 'fxc-qvff':63B,90C 'ghsa':16A,21A,60B,87C 'ghsa-49q5-vjx7-5gwr':15A,20A 'httpsys':30B 'let':42B 'link':94C 'maintain':96C 'microsoft':3A 'microsoft.aspnetcore.server.httpsys':25A,34B 'network':45B,118C 'nuget':31B 'one':71B 'origin':101C 'packag':32B 'preserv':98C 'qvff':65B,92C 'refer':100C 'resourc':38B,48B,104C 'secur':4A 'servic':13A,51B,115C 'track':73B 'unauthor':44B,111C 'uncontrol':37B,103C 'vjx7':18A,23A 'vulner':14A 'window':33B 'withdrawn':55B,80C","nicknames":[],"mitigations":[],"who_affected":"Applications that host ASP.NET Core with the HttpSys server on Windows and accept network traffic are the ones exposed. Apps behind a different server such as Kestrel, or not reachable from the network, are less likely affected. Because the advisory is withdrawn, the duplicate GHSA-3893-7fxc-qvff carries the working data.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftaspnetcoreserverhttpsys"],"ptokens":["aspnetcore","httpsys","microsoft","server"],"labels":["aspnetcore","cwe401","high","httpsys","nuget","package","windows"],"campaign_type":null,"search_a":"'-114154':8A '-2026':7A '49q5':17A,22A '5gwr':19A,24A 'advisori':2A,5A 'asp.net':9A 'core':10A 'cve':6A 'denial':11A 'duplic':1A 'ghsa':16A,21A 'ghsa-49q5-vjx7-5gwr':15A,20A 'microsoft':3A 'microsoft.aspnetcore.server.httpsys':25A 'secur':4A 'servic':13A 'vjx7':18A,23A 'vulner':14A","search_b":"'-3893':61B '-401':29B '-7':62B 'advisori':53B,68B 'asp.net':26B 'attack':46B 'consumpt':39B 'core':27B 'cwe':28B 'deni':50B 'duplic':58B 'exhaust':47B 'flaw':40B 'fxc':64B 'fxc-qvff':63B 'ghsa':60B 'httpsys':30B 'let':42B 'microsoft.aspnetcore.server.httpsys':34B 'network':45B 'nuget':31B 'one':71B 'packag':32B 'qvff':65B 'resourc':38B,48B 'servic':51B 'track':73B 'unauthor':44B 'uncontrol':37B 'window':33B 'withdrawn':55B","search_c":"'-3893':88C '-7':89C 'advisori':75C,77C 'allow':109C 'asp.net':107C 'attack':112C 'consumpt':105C 'core':108C 'deni':114C 'descript':102C 'duplic':74C,85C 'extern':99C 'fxc':91C 'fxc-qvff':90C 'ghsa':87C 'link':94C 'maintain':96C 'network':118C 'origin':101C 'preserv':98C 'qvff':92C 'refer':100C 'resourc':104C 'servic':115C 'unauthor':111C 'uncontrol':103C 'withdrawn':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:32:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-49q5-vjx7-5gwr","url":"https://github.com/advisories/GHSA-49q5-vjx7-5gwr","severity":"high","published_at":"2026-11-10T21:32:51+00:00","modified_at":"2026-11-10T22:07:41+00:00","first_seen_at":"2026-11-10T22:12:11+00:00","fetched_at":"2026-11-10T22:17:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}