CVE-2026-56170: ASP.NET Core DOS Vulnerability

CVE-2026-56170 Overview

CVE-2026-56170 is a denial-of-service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling [CWE-770]. An unauthorized remote attacker can send crafted network requests that exhaust server resources and prevent legitimate users from accessing hosted applications. Microsoft published the advisory through the Microsoft Security Response Center.

The flaw requires no authentication, no user interaction, and low attack complexity. Successful exploitation impacts availability only, with no effect on confidentiality or integrity.

Critical Impact
Unauthenticated network attackers can disrupt ASP.NET Core web applications by triggering unbounded resource allocation, leading to service outages.

Affected Products

ASP.NET Core (see Microsoft Security Update Guide for exact affected versions)

Discovery Timeline

2026-07-14 - CVE-2026-56170 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-56170

Vulnerability Analysis

The vulnerability resides in how ASP.NET Core allocates resources for incoming requests. The runtime fails to enforce upper bounds or throttle certain allocations, allowing an attacker to consume memory, CPU, or connection resources beyond safe operational limits.

Because the attack vector is the network and no privileges or user interaction are required, any publicly reachable ASP.NET Core endpoint is potentially exposed. The EPSS score is approximately 0.798%, indicating limited but non-trivial predicted exploitation activity.

Sustained exploitation can cause worker processes to exhaust available memory or thread pool capacity. The result is service degradation or full unavailability for legitimate users of the hosted application.

Root Cause

The root cause is classified under CWE-770: Allocation of Resources Without Limits or Throttling. ASP.NET Core code paths accept attacker-influenced input and allocate resources proportional to that input without enforcing hard ceilings or rate limits.

Attack Vector

An attacker sends specifically crafted HTTP requests to an ASP.NET Core application over the network. Repeated or amplified requests cause the server to allocate resources faster than they can be released, driving the process toward exhaustion.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Technical specifics are documented in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-56170

Indicators of Compromise

Sudden spikes in memory or CPU utilization on ASP.NET Core worker processes without a corresponding rise in legitimate traffic.
Repeated large or malformed requests from single or distributed source IP addresses targeting the same endpoints.
HTTP 503 responses, request queue saturation, or Kestrel connection resets under otherwise normal load conditions.

Detection Strategies

Baseline normal request sizes, request rates, and memory profiles for each ASP.NET Core application, then alert on statistical deviations.
Inspect web server and reverse proxy logs for anomalous request patterns targeting endpoints that accept variable-length input.
Correlate application performance monitoring (APM) metrics with network telemetry to distinguish organic traffic surges from resource-exhaustion attempts.

Monitoring Recommendations

Enable detailed Kestrel and IIS logging, including request size, duration, and connection lifecycle events.
Monitor .NET runtime counters for thread pool starvation, GC pressure, and working set growth on hosts running ASP.NET Core.
Forward web, host, and runtime logs to a centralized analytics platform for cross-source correlation and long-term retention.

How to Mitigate CVE-2026-56170

Immediate Actions Required

Apply the ASP.NET Core security updates referenced in the Microsoft Security Update Guide to all affected hosts.
Inventory internet-facing ASP.NET Core applications and prioritize patching for those with the highest exposure.
Restrict inbound access to management and non-public endpoints using network segmentation or firewall rules.

Patch Information

Microsoft has released updates addressing CVE-2026-56170 through its standard servicing channels. Refer to the Microsoft Security Update Guide for the exact package versions and installation instructions that apply to your ASP.NET Core deployment.

Workarounds

Configure request size limits using MaxRequestBodySize and header size limits in Kestrel to cap attacker-controlled input.
Deploy rate limiting via the ASP.NET Core rate limiting middleware or an upstream reverse proxy such as IIS, NGINX, or a WAF.
Set aggressive connection, request, and keep-alive timeouts to release resources held by slow or abusive clients.
Place ASP.NET Core applications behind a WAF or CDN capable of absorbing volumetric traffic and filtering malformed requests.

bash

# Configuration example: enforce Kestrel request and connection limits
# In Program.cs for ASP.NET Core
builder.WebHost.ConfigureKestrel(options =>
{
    options.Limits.MaxRequestBodySize = 1_048_576;         // 1 MB
    options.Limits.MaxRequestHeadersTotalSize = 32_768;    // 32 KB
    options.Limits.MaxConcurrentConnections = 1000;
    options.Limits.MaxConcurrentUpgradedConnections = 100;
    options.Limits.KeepAliveTimeout = TimeSpan.FromSeconds(30);
    options.Limits.RequestHeadersTimeout = TimeSpan.FromSeconds(15);
});