CVE-2026-45646: Microsoft ASP.NET Core OData DOS Vulnerability

CVE-2026-45646 Overview

CVE-2026-45646 is a denial-of-service vulnerability in Microsoft ASP.NET Core OData and OData Web API. The flaw stems from allocation of resources without limits or throttling [CWE-770]. An unauthenticated remote attacker can send crafted OData requests that exhaust server resources, rendering the service unavailable to legitimate users. The vulnerability is exploitable over the network without user interaction or prior privileges.

Critical Impact

Unauthenticated remote attackers can trigger resource exhaustion in ASP.NET Core OData services, causing sustained denial of service to any application exposing OData endpoints.

Affected Products

• Microsoft ASP.NET Core OData
• Microsoft OData Web API
• Applications built on the affected OData libraries exposing query endpoints

Discovery Timeline

• 2026-07-14 - CVE-2026-45646 published to the National Vulnerability Database
• 2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-45646

Vulnerability Analysis

The vulnerability affects the OData query processing layer in ASP.NET Core OData and OData Web API. OData exposes rich query capabilities through URL parameters such as $filter, $expand, $orderby, and $select. When these query options lack enforced limits, the server allocates memory, CPU cycles, and database resources proportional to attacker-controlled input.

An unauthenticated attacker can issue requests that trigger disproportionate backend work. Repeated or concurrent requests amplify the effect, exhausting server capacity and denying service to legitimate clients. The vulnerability requires only network access to an exposed OData endpoint.

Root Cause

The root cause maps to [CWE-770] Allocation of Resources Without Limits or Throttling. The affected libraries process query components without enforcing bounds on cardinality, depth, or execution cost. This design gap allows a single request to consume resources far beyond typical workloads.

Attack Vector

Exploitation occurs over the network against any HTTP endpoint exposing OData services. The attacker crafts query strings that force expensive server-side operations such as deep expansions, complex filters, or large result set materialization. No authentication, user interaction, or elevated privileges are required.

Because the request pattern resembles legitimate OData traffic, distinguishing malicious from benign requests requires behavioral analysis rather than signature matching. Microsoft has not published proof-of-concept code, and no public exploit is currently available. Refer to the Microsoft Security Update CVE-2026-45646 advisory for authoritative technical details.

Detection Methods for CVE-2026-45646

Indicators of Compromise

• Sudden spikes in CPU, memory, or database load correlated with inbound OData query traffic
• HTTP requests containing unusually large or deeply nested $expand, $filter, or $orderby parameters
• Elevated request latency or HTTP 5xx errors from endpoints served by ASP.NET Core OData
• Repeated requests from the same source targeting the same OData resource path

Detection Strategies

• Parse web server and reverse proxy logs for OData query strings exceeding baseline length or complexity thresholds
• Correlate application performance telemetry with request logs to identify queries producing outsized resource consumption
• Enable ASP.NET Core request logging and monitor for repeated failed or timed-out requests to OData controllers

Monitoring Recommendations

• Instrument OData endpoints with Application Insights or equivalent APM to track per-request CPU and memory cost
• Configure alerts on sustained request rate anomalies against endpoints registered with MapODataRoute or AddOData
• Track database query duration and row counts originating from OData controllers to spot amplification patterns

How to Mitigate CVE-2026-45646

Immediate Actions Required

• Apply the security update referenced in the Microsoft Security Update CVE-2026-45646 advisory
• Inventory all applications using Microsoft.AspNetCore.OData and Microsoft.AspNet.OData packages and prioritize internet-facing services
• Place rate limiting and request size restrictions in front of OData endpoints until patches are deployed

Patch Information

Microsoft has published fixed package versions through the MSRC advisory. Update the affected NuGet packages to the versions listed in the Microsoft Security Update CVE-2026-45646 guidance and redeploy affected services.

Workarounds

• Enforce OData query limits by configuring MaxTop, MaxExpansionDepth, MaxNodeCount, and MaxAnyAllExpressionDepth on the ODataOptions
• Disable unused query options such as $expand or $filter on endpoints that do not require them
• Deploy ASP.NET Core rate limiting middleware or a web application firewall rule to throttle requests per client to OData routes
• Restrict OData endpoint exposure to authenticated users where business requirements allow

# Configuration example: enforce OData query limits in Program.cs
builder.Services.AddControllers().AddOData(options =>
    options
        .Select()
        .Filter()
        .OrderBy()
        .SetMaxTop(100)
        .Expand()
        .Count());

// Restrict expansion depth and node count
builder.Services.Configure<ODataOptions>(opt =>
{
    opt.QuerySettings.DefaultMaxExpansionDepth = 2;
    opt.QuerySettings.MaxNodeCount = 100;
});