CVE-2026-109468: ASP.NET Core DOS Vulnerability

CVE-2026-109468 Overview

CVE-2026-109468 is a denial-of-service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling [CWE-770]. An unauthenticated remote attacker can send crafted network requests that force the application to consume excessive resources. Successful exploitation renders the targeted service unavailable to legitimate users.

The flaw requires no privileges and no user interaction. It affects the availability of the application layer without impacting confidentiality or integrity. Microsoft published a security update addressing the issue through its Security Response Center advisory.

Critical Impact
An unauthenticated network attacker can exhaust server resources in ASP.NET Core applications and cause a denial of service across public-facing web endpoints.

Affected Products

ASP.NET Core (versions addressed by the Microsoft security update)
Web applications and APIs built on ASP.NET Core
Services exposing ASP.NET Core HTTP endpoints over the network

Discovery Timeline

2026-10-15 - CVE-2026-109468 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-109468

Vulnerability Analysis

The vulnerability stems from ASP.NET Core allocating resources during request processing without enforcing adequate limits or throttling. An attacker crafts network requests that trigger repeated or oversized allocations within the request pipeline. The server consumes memory, threads, or connection resources until it can no longer serve legitimate traffic.

Because the attack vector is the network and no authentication is required, any reachable ASP.NET Core endpoint is a candidate target. The impact is limited to availability, but a sustained attack can take down production web services and APIs. Downstream components such as load balancers and dependent microservices may also degrade.

Root Cause

The root cause falls under [CWE-770]: Allocation of Resources Without Limits or Throttling. ASP.NET Core request-processing code paths accept input that drives resource allocation without bounding the quantity, size, or rate. Attackers abuse this to force the runtime into an exhausted state.

Attack Vector

Exploitation occurs over the network against an exposed ASP.NET Core endpoint. The attacker sends crafted or high-volume requests to a vulnerable route. The server allocates resources for each request without applying throttling, leading to resource exhaustion and service denial. No valid credentials or user interaction are needed.

The vulnerability manifests inside the ASP.NET Core request pipeline. See the Microsoft Security Update for CVE-2026-109468 for authoritative technical details.

Detection Methods for CVE-2026-109468

Indicators of Compromise

Sudden spikes in memory, thread, or connection pool utilization on ASP.NET Core hosts without a corresponding increase in legitimate user traffic.
Repeated requests to the same endpoint from a small number of source IPs with unusually large payloads or atypical headers.
Elevated HTTP 503 or 504 responses, request timeouts, and process restarts triggered by health checks or orchestrators.

Detection Strategies

Baseline normal request rates and resource consumption per endpoint, then alert on statistical deviations.
Correlate web server logs with runtime metrics such as working set size, thread count, and Kestrel connection counts.
Inspect reverse proxy logs for anomalous request sizes, slow request patterns, or repeated requests triggering heavy allocations.

Monitoring Recommendations

Monitor Application Insights or equivalent telemetry for Kestrel request duration, queue length, and failed request counts.
Track per-source IP request rates at the edge and alert on rate anomalies against ASP.NET Core routes.
Forward web, runtime, and infrastructure logs to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2026-109468

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all affected ASP.NET Core deployments.
Inventory ASP.NET Core applications and runtimes to identify vulnerable versions across production, staging, and build environments.
Place rate limiting and request-size controls in front of exposed endpoints until patches are deployed.

Patch Information

Microsoft has published a security update for CVE-2026-109468. Review the Microsoft Security Update for CVE-2026-109468 for the specific fixed versions of the ASP.NET Core runtime and shared framework packages. Update dependent NuGet packages and redeploy applications after upgrading the runtime.

Workarounds

Enable the ASP.NET Core rate-limiting middleware and configure per-endpoint request quotas aligned to expected traffic.
Enforce request body size limits using KestrelServerOptions.Limits.MaxRequestBodySize and tighten header and connection limits.
Front ASP.NET Core services with a web application firewall or reverse proxy that applies rate limiting, connection throttling, and anomaly filtering.

bash

# Configuration example: apply Kestrel limits and rate limiting in Program.cs
# builder.Services.AddRateLimiter(options => options.AddFixedWindowLimiter(
#     policyName: "fixed", opt => { opt.PermitLimit = 100; opt.Window = TimeSpan.FromMinutes(1); }));
# builder.WebHost.ConfigureKestrel(o => {
#     o.Limits.MaxRequestBodySize = 1_048_576;      // 1 MB
#     o.Limits.MaxConcurrentConnections = 1000;
#     o.Limits.MaxRequestHeadersTotalSize = 32_768; // 32 KB
# });