---
id: "GHSA-wrm2-c2h2-4w82"
page: "https://infrastack.ai/live/GHSA-wrm2-c2h2-4w82"
kind: "vulnerability"
aliases: ["GHSA-wrm2-c2h2-4w82"]
title: "Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "withdrawn"
category: "runtime"
products: [{"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": [], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}]
ecosystems: ["nuget"]
tags: ["aspnet-core", "cwe-407", "dotnet", "linux-arm", "runtime", "self-hosted"]
not_affected_if: ["outside-affected-range"]
published_at: "2026-11-10T21:32:29+00:00"
first_seen_at: "2026-11-11T00:24:45+00:00"
updated_at: "2026-11-11T00:25:36+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-wrm2-c2h2-4w82", "first_seen_at": "2026-11-11T00:24:45+00:00"}]
exploit_sources: []
---

# Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability

Link for people: https://infrastack.ai/live/GHSA-wrm2-c2h2-4w82 (this .md is for agents)

ASP.NET Core has an inefficient algorithm that an unauthorized attacker can trigger over the network to make the service unavailable. This advisory is withdrawn as a duplicate of GHSA-r3qf-p3jm-8h4p, so the live entry is that one.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed no fixed version listed

## How to check

- Check the installed ASP.NET Core runtime version with `dotnet --list-runtimes`
- Compare it against the affected range listed for Microsoft.AspNetCore.App.Runtime.linux-arm, `>= 8.0.0-preview.1.23112.2`, `<= 8.0.33`
- Check GHSA-r3qf-p3jm-8h4p for the live advisory and its fixed version

## Fix

- Fixed version: unknown for this withdrawn entry; see GHSA-r3qf-p3jm-8h4p

## Timeline

- 2026-11-11T00:24:45+00:00 ghsa https://github.com/advisories/GHSA-wrm2-c2h2-4w82

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r3qf-p3jm-8h4p. This link is maintained to preserve external references.

## Original Description
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_