Vulnerability · Published Jun 9, 2026 · Assigned by microsoft

CVE-2026-45591ASP.NET Core Denial of Service Vulnerability

High 7.5

In plain English

A high-severity uncontrolled resource consumption in ASP.NET Core 10.0 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10aspnetcore-runtime-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8aspnetcore-runtime-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9aspnetcore-runtime-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10aspnetcore-runtime-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8aspnetcore-runtime-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9aspnetcore-runtime-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10aspnetcore-runtime-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8aspnetcore-runtime-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9aspnetcore-runtime-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:10aspnetcore-runtime-dbg-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8aspnetcore-runtime-dbg-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9aspnetcore-runtime-dbg-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10aspnetcore-runtime-dbg-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8aspnetcore-runtime-dbg-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9aspnetcore-runtime-dbg-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10aspnetcore-runtime-dbg-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8aspnetcore-runtime-dbg-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9aspnetcore-runtime-dbg-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:10aspnetcore-targeting-pack-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8aspnetcore-targeting-pack-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9aspnetcore-targeting-pack-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10aspnetcore-targeting-pack-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8aspnetcore-targeting-pack-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9aspnetcore-targeting-pack-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10aspnetcore-targeting-pack-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8aspnetcore-targeting-pack-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9aspnetcore-targeting-pack-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:8dotnet10.0.109-1.el8_10ALSA-2026:25114
AlmaLinux:10dotnet-apphost-pack-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-apphost-pack-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-apphost-pack-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-apphost-pack-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-apphost-pack-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-apphost-pack-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-apphost-pack-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-apphost-pack-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-apphost-pack-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-host10.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-host10.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-host10.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-hostfxr-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-hostfxr-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-hostfxr-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-hostfxr-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-hostfxr-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-hostfxr-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-hostfxr-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-hostfxr-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-hostfxr-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-runtime-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-runtime-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-runtime-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-runtime-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-runtime-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-runtime-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-runtime-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-runtime-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-runtime-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-runtime-dbg-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-runtime-dbg-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-runtime-dbg-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-runtime-dbg-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-runtime-dbg-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-runtime-dbg-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-runtime-dbg-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-runtime-dbg-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-runtime-dbg-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-sdk-10.010.0.109-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-sdk-10.010.0.109-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-sdk-10.010.0.109-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-sdk-10.0-source-built-artifacts10.0.109-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-sdk-10.0-source-built-artifacts10.0.109-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-sdk-10.0-source-built-artifacts10.0.109-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-sdk-8.08.0.128-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-sdk-8.08.0.128-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-sdk-8.08.0.128-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-sdk-8.0-source-built-artifacts8.0.128-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-sdk-8.0-source-built-artifacts8.0.128-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-sdk-8.0-source-built-artifacts8.0.128-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-sdk-9.09.0.118-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-sdk-9.09.0.118-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-sdk-9.09.0.118-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-sdk-9.0-source-built-artifacts9.0.118-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-sdk-9.0-source-built-artifacts9.0.118-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-sdk-9.0-source-built-artifacts9.0.118-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-sdk-aot-10.010.0.109-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-sdk-aot-10.010.0.109-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-sdk-aot-10.010.0.109-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-sdk-aot-9.09.0.118-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-sdk-aot-9.09.0.118-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-sdk-aot-9.09.0.118-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-sdk-dbg-10.010.0.109-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-sdk-dbg-10.010.0.109-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-sdk-dbg-10.010.0.109-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-sdk-dbg-8.08.0.128-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-sdk-dbg-8.08.0.128-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-sdk-dbg-8.08.0.128-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-sdk-dbg-9.09.0.118-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-sdk-dbg-9.09.0.118-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-sdk-dbg-9.09.0.118-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-targeting-pack-10.010.0.9-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-targeting-pack-10.010.0.9-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-targeting-pack-10.010.0.9-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-targeting-pack-8.08.0.28-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-targeting-pack-8.08.0.28-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-targeting-pack-8.08.0.28-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-targeting-pack-9.09.0.17-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-targeting-pack-9.09.0.17-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-targeting-pack-9.09.0.17-1.el9_8ALSA-2026:25221
AlmaLinux:10dotnet-templates-10.010.0.109-1.el10_2ALSA-2026:25115
AlmaLinux:8dotnet-templates-10.010.0.109-1.el8_10ALSA-2026:25114
AlmaLinux:9dotnet-templates-10.010.0.109-1.el9_8ALSA-2026:25222
AlmaLinux:10dotnet-templates-8.08.0.128-1.el10_2ALSA-2026:25111
AlmaLinux:8dotnet-templates-8.08.0.128-1.el8_10ALSA-2026:25110
AlmaLinux:9dotnet-templates-8.08.0.128-1.el9_8ALSA-2026:25220
AlmaLinux:10dotnet-templates-9.09.0.118-1.el10_2ALSA-2026:25112
AlmaLinux:8dotnet-templates-9.09.0.118-1.el8_10ALSA-2026:25113
AlmaLinux:9dotnet-templates-9.09.0.118-1.el9_8ALSA-2026:25221
AlmaLinux:10netstandard-targeting-pack-2.19.0.118-1.el10_2ALSA-2026:25112
AlmaLinux:8netstandard-targeting-pack-2.19.0.118-1.el8_10ALSA-2026:25113
AlmaLinux:9netstandard-targeting-pack-2.19.0.118-1.el9_8ALSA-2026:25221
Alpine:v3.23dotnet10-runtime10.0.9-r0ALPINE-CVE-2026-45591
Alpine:v3.24dotnet10-runtime10.0.9-r0ALPINE-CVE-2026-45591
Alpine:v3.22dotnet8-runtime8.0.28-r0ALPINE-CVE-2026-45591
Alpine:v3.23dotnet8-runtime8.0.28-r0ALPINE-CVE-2026-45591
Alpine:v3.24dotnet8-runtime8.0.28-r0ALPINE-CVE-2026-45591
Alpine:v3.21dotnet9-runtime9.0.17-r0ALPINE-CVE-2026-45591
Alpine:v3.22dotnet9-runtime9.0.17-r0ALPINE-CVE-2026-45591
Alpine:v3.23dotnet9-runtime9.0.17-r0ALPINE-CVE-2026-45591
Alpine:v3.24dotnet9-runtime9.0.17-r0ALPINE-CVE-2026-45591
NuGetmicrosoft.aspnetcore.app.runtime.linux-x6410.0.9GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.linux-x648.0.28GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.linux-x649.0.17GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.osx-arm648.0.28GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.osx-arm6410.0.9GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.osx-arm649.0.17GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.win-x649.0.17GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.win-x648.0.28GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.app.runtime.win-x6410.0.9GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.signalr.protocols.messagepack9.0.17GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.signalr.protocols.messagepack8.0.28GHSA-f8h2-vmm9-qhj6
NuGetmicrosoft.aspnetcore.signalr.protocols.messagepack10.0.9GHSA-f8h2-vmm9-qhj6
Rocky Linux:10dotnet10.00:10.0.109-1.el10_2RLSA-2026:25115
Rocky Linux:8dotnet10.00:10.0.109-1.el8_10RLSA-2026:25114
Rocky Linux:9dotnet10.00:10.0.109-1.el9_8RLSA-2026:25222
Rocky Linux:10dotnet8.00:8.0.128-1.el10_2RLSA-2026:25111
Rocky Linux:8dotnet8.00:8.0.128-1.el8_10RLSA-2026:25110
Rocky Linux:9dotnet8.00:8.0.128-1.el9_8RLSA-2026:25220
Rocky Linux:10dotnet9.00:9.0.118-1.el10_2RLSA-2026:25112
Rocky Linux:8dotnet9.00:9.0.118-1.el8_10RLSA-2026:25113
Rocky Linux:9dotnet9.00:9.0.118-1.el9_8RLSA-2026:25221
Ubuntu:24.04:LTSdotnet1010.0.109-10.0.9-0ubuntu1~24.04.1UBUNTU-CVE-2026-45591
Ubuntu:25.10dotnet1010.0.109-10.0.9-0ubuntu1~25.10.1UBUNTU-CVE-2026-45591
Ubuntu:26.04:LTSdotnet1010.0.109-10.0.9-0ubuntu1~26.04.1UBUNTU-CVE-2026-45591
Ubuntu:26.10dotnet1010.0.109-10.0.9-0ubuntu1UBUNTU-CVE-2026-45591
Ubuntu:22.04:LTSdotnet6no fix listedUBUNTU-CVE-2026-45591
Ubuntu:22.04:LTSdotnet7no fix listedUBUNTU-CVE-2026-45591
Ubuntu:22.04:LTSdotnet88.0.128-8.0.28-0ubuntu1~22.04.1UBUNTU-CVE-2026-45591
Ubuntu:24.04:LTSdotnet88.0.128-8.0.28-0ubuntu1~24.04.1UBUNTU-CVE-2026-45591
Ubuntu:25.10dotnet88.0.128-8.0.28-0ubuntu1~25.10.1UBUNTU-CVE-2026-45591
Ubuntu:25.10dotnet99.0.118-9.0.17-0ubuntu1~25.10.1UBUNTU-CVE-2026-45591

Affected products (as reported)

VendorProductVersions
Microsoft .NET 10.0 10.0.0 – before 10.0.9
Microsoft .NET 8.0 8.0.0 – before 8.0.28
Microsoft .NET 9.0 9.0.0 – before 9.0.17
Microsoft ASP.NET Core 10.0 10.0 – before 10.0.9
Microsoft ASP.NET Core 8.0 8.0 – before 8.0.28
Microsoft ASP.NET Core 9.0 9.0 – before 9.0.17
Microsoft Microsoft Visual Studio 2026 version 18.6 18.6.0 – before 18.6.3

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References