CVE-2026-50506: ASP.NET Core DOS Vulnerability

CVE-2026-50506 Overview

CVE-2026-50506 is a denial of service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling [CWE-770]. An unauthenticated remote attacker can exhaust server resources by sending crafted network requests. The flaw affects the availability of applications built on ASP.NET Core and does not require user interaction or prior authentication. Microsoft published guidance for this issue through the Microsoft Security Response Center (MSRC).

Critical Impact
An unauthenticated attacker can remotely exhaust server resources on affected ASP.NET Core deployments, causing service outages for web applications and APIs.

Affected Products

ASP.NET Core (versions listed in Microsoft's advisory)
Web applications and APIs built on affected ASP.NET Core runtimes
Services exposing HTTP endpoints processed by vulnerable ASP.NET Core components

Discovery Timeline

2026-07-14 - CVE CVE-2026-50506 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-50506

Vulnerability Analysis

The vulnerability is a resource exhaustion issue in ASP.NET Core. The framework fails to apply appropriate limits or throttling when allocating resources during request processing. An attacker can exploit this behavior over a network without credentials or user interaction. The impact is limited to availability. Confidentiality and integrity are not affected.

Successful exploitation causes the affected process to consume excessive memory, CPU, or other resources until the service becomes unresponsive. Because the attack vector is remote and requires no privileges, exposed web endpoints are directly reachable by any network attacker.

Root Cause

The root cause is classified under [CWE-770] Allocation of Resources Without Limits or Throttling. A code path in ASP.NET Core accepts input that drives resource allocation without enforcing an upper bound. Repeated or oversized requests amplify allocation until the host cannot service additional work. See the Microsoft Security Update for CVE-2026-50506 for the specific component and code path.

Attack Vector

An attacker sends crafted HTTP requests to a public or reachable ASP.NET Core endpoint. The requests trigger unbounded allocation in the vulnerable component. Sustained requests drive the process into resource exhaustion. No authentication, user interaction, or elevated privileges are required. The exploit requires only network reachability to a vulnerable service.

The vulnerability manifests in server-side request handling logic. Refer to Microsoft's advisory for the exact protocol behavior and preconditions rather than synthetic exploitation code.

Detection Methods for CVE-2026-50506

Indicators of Compromise

Sustained spikes in memory or CPU consumption by dotnet or Kestrel worker processes without a matching increase in legitimate traffic
Repeated HTTP requests from a small number of source addresses correlated with application unresponsiveness or timeouts
Application logs showing OutOfMemoryException, thread pool starvation warnings, or connection queue overflows

Detection Strategies

Baseline normal request rates, request sizes, and resource utilization for each ASP.NET Core service, then alert on statistically significant deviations
Monitor Kestrel and IIS telemetry for abnormal connection counts, long request durations, and abrupt drops in successful responses
Correlate web access logs with process telemetry to identify low-volume request patterns that produce disproportionate resource consumption

Monitoring Recommendations

Ingest ASP.NET Core diagnostic counters (Microsoft.AspNetCore.Hosting, System.Runtime) into a centralized monitoring platform
Enable request rate limiting metrics and alert when configured thresholds are approached or exceeded
Track upstream load balancer or WAF metrics for elevated 5xx responses and connection resets targeting ASP.NET Core endpoints

How to Mitigate CVE-2026-50506

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-50506 to all affected ASP.NET Core runtimes
Inventory all applications and containers running ASP.NET Core and prioritize internet-facing services for patching
Restart affected services after patch installation to load the fixed assemblies

Patch Information

Microsoft has released updates addressing CVE-2026-50506. Consult the Microsoft Security Update guide for the list of fixed runtime versions, package identifiers, and installation guidance for Windows, Linux, and container deployments.

Workarounds

Enforce request rate limiting using the ASP.NET Core rate limiting middleware (Microsoft.AspNetCore.RateLimiting) to cap concurrent and total requests per client
Configure Kestrel request size and connection limits, including MaxRequestBodySize, MaxConcurrentConnections, and request header limits
Deploy a web application firewall or reverse proxy in front of ASP.NET Core services to enforce request size, rate, and connection limits
Restrict network exposure of non-public endpoints using firewall rules or private networking until the patch is applied

bash

# Example Kestrel and rate limiting configuration in appsettings.json
{
  "Kestrel": {
    "Limits": {
      "MaxConcurrentConnections": 1000,
      "MaxConcurrentUpgradedConnections": 100,
      "MaxRequestBodySize": 1048576,
      "MaxRequestHeaderCount": 100,
      "MaxRequestLineSize": 8192
    }
  },
  "RateLimiting": {
    "PermitLimit": 100,
    "Window": "00:00:10",
    "QueueLimit": 0
  }
}