CVE-2026-45591: ASP.NET Core DoS Vulnerability

CVE-2026-45591 Overview

CVE-2026-45591 is an uncontrolled resource consumption vulnerability in ASP.NET Core. An unauthorized attacker can deny service over a network without requiring authentication or user interaction. The flaw maps to [CWE-400] (Uncontrolled Resource Consumption) and impacts the availability of affected web applications and services built on the framework.

Microsoft disclosed the issue through the Microsoft Security Response Center (MSRC). The vulnerability carries an EPSS probability in the 82nd percentile, indicating elevated likelihood of exploit activity relative to other published CVEs.

Critical Impact
A remote, unauthenticated attacker can exhaust server resources and render ASP.NET Core applications unavailable to legitimate users.

Affected Products

ASP.NET Core (version range not specified in NVD data)
Applications and services built on the affected ASP.NET Core runtime
Refer to the Microsoft Security Update CVE-2026-45591 for the authoritative product and version list

Discovery Timeline

2026-06-09 - CVE-2026-45591 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45591

Vulnerability Analysis

The vulnerability stems from uncontrolled resource consumption within ASP.NET Core request processing. An attacker sends crafted network requests that cause the framework to allocate disproportionate CPU, memory, or thread resources relative to the work performed. Sustained or repeated requests exhaust available capacity and prevent the application from servicing legitimate traffic.

The issue is network-reachable and requires no privileges or user interaction. Confidentiality and integrity are not impacted, but availability is fully compromised on affected hosts. Public exploit code is not currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a failure to bound resource usage during request handling, classified as [CWE-400]. ASP.NET Core does not adequately constrain the resources consumed when processing certain attacker-supplied inputs. Without sufficient limits on parsing, allocation, or processing time, a single low-cost request from the attacker translates into a high-cost operation on the server.

Attack Vector

The attack vector is network-based. An adversary with HTTP or HTTPS reach to a vulnerable ASP.NET Core endpoint sends malformed or computationally expensive requests. No authentication is required. The attacker repeats or parallelizes the request pattern to saturate worker threads, memory, or CPU until the service becomes unresponsive. Refer to the Microsoft Security Update CVE-2026-45591 for additional technical context.

Detection Methods for CVE-2026-45591

Indicators of Compromise

Spikes in CPU, memory, or thread pool utilization on ASP.NET Core hosts without a corresponding increase in legitimate user traffic
HTTP request patterns from a small set of source IPs targeting the same endpoint with abnormally large payloads or unusual parameters
Increased request latency, HTTP 503 responses, and Kestrel worker process restarts in application logs

Detection Strategies

Baseline normal request rates and resource utilization per ASP.NET Core endpoint, then alert on statistical deviations
Inspect web server and application logs for repeated requests with elevated processing times originating from the same client
Correlate web application firewall (WAF) telemetry with backend resource exhaustion events to identify request fingerprints associated with the attack

Monitoring Recommendations

Enable performance counters for Kestrel, thread pool queue length, and garbage collection pressure
Forward IIS, Kestrel, and application logs to a centralized log analytics platform for retention and querying
Configure alerting thresholds for sustained high CPU, memory exhaustion, and 5xx response rate increases

How to Mitigate CVE-2026-45591

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45591 advisory to all affected ASP.NET Core deployments
Inventory hosts running ASP.NET Core and prioritize internet-exposed services for patching
Restrict network exposure of management and non-public endpoints to trusted networks only

Patch Information

Microsoft has released a security update addressing CVE-2026-45591. Administrators should consult the Microsoft Security Update CVE-2026-45591 page for the affected version matrix and update package details. Apply the corresponding runtime or SDK update and redeploy applications that bundle the ASP.NET Core runtime.

Workarounds

Place a WAF or reverse proxy in front of ASP.NET Core applications and enforce request size, rate, and timeout limits
Configure Kestrel limits such as MaxConcurrentConnections, MaxRequestBodySize, and request header timeouts to reduce attack surface
Implement per-IP rate limiting and connection throttling at the load balancer until patches are deployed

bash

# Example Kestrel hardening in appsettings.json
{
  "Kestrel": {
    "Limits": {
      "MaxConcurrentConnections": 1000,
      "MaxRequestBodySize": 1048576,
      "RequestHeadersTimeout": "00:00:30",
      "KeepAliveTimeout": "00:01:00"
    }
  }
}