CVE-2026-57099: ASP.NET Core DOS Vulnerability

CVE-2026-57099 Overview

CVE-2026-57099 is a denial-of-service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling [CWE-770]. An unauthenticated remote attacker can exhaust server resources over the network, rendering affected applications unavailable to legitimate users. The vulnerability requires no privileges and no user interaction, making it trivial to trigger against exposed endpoints. Microsoft published the advisory on September 8, 2026.

Critical Impact

Unauthenticated network attackers can exhaust server resources and cause complete service unavailability on affected ASP.NET Core deployments.

Affected Products

• ASP.NET Core (version details available in the Microsoft Vulnerability Advisory CVE-2026-57099)
• Web applications and APIs built on affected ASP.NET Core runtimes
• Kestrel-hosted services exposed to untrusted network traffic

Discovery Timeline

• 2026-09-08 - CVE-2026-57099 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-57099

Vulnerability Analysis

The flaw resides in ASP.NET Core request-handling paths that allocate memory, threads, or connection-related resources without enforcing sufficient limits. An attacker sends crafted network requests that force the framework to allocate resources at a rate the server cannot sustain. Because the vulnerability affects availability only, confidentiality and integrity remain intact, but hosted services become unresponsive under sustained exploitation. Microsoft classifies the issue under CWE-770: Allocation of Resources Without Limits or Throttling.

Root Cause

The root cause is missing enforcement of upper bounds on resource allocation during request processing. ASP.NET Core accepts inputs or connection patterns that translate into unbounded server-side allocations. Without throttling controls, adversary-controlled inputs directly consume server memory, CPU cycles, or connection pool capacity until the process degrades or crashes.

Attack Vector

Exploitation occurs over the network against any reachable ASP.NET Core endpoint. The attacker requires no authentication, no elevated privileges, and no interaction from a user or administrator. A single low-complexity request stream is sufficient to trigger the resource exhaustion condition, according to the current EPSS probability of 0.818%. Public exploit code has not been observed at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. See the Microsoft Vulnerability Advisory CVE-2026-57099 for authoritative technical details.

Detection Methods for CVE-2026-57099

Indicators of Compromise

• Sudden spikes in memory, CPU, or thread-pool utilization on ASP.NET Core hosts without a corresponding rise in legitimate user activity.
• High volumes of requests from a small set of source IP addresses targeting the same endpoint or protocol handler.
• Repeated Kestrel or IIS worker process restarts, out-of-memory events, or HTTP 503 responses in application logs.

Detection Strategies

• Correlate web server telemetry with process-level resource metrics to identify allocation growth that outpaces request throughput.
• Deploy web application firewall rules that rate-limit anomalous request patterns and payload sizes against exposed ASP.NET Core services.
• Alert on abnormal ratios of concurrent connections to completed requests, which often indicate resource-hoarding behavior.

Monitoring Recommendations

• Ingest IIS, Kestrel, and .NET runtime logs into a centralized analytics platform for baseline and anomaly comparison.
• Track .NET performance counters including # Bytes in all Heaps, ThreadPool Thread Count, and connection queue depth.
• Enable alerting on repeated application restarts, unhandled OutOfMemoryException events, and sustained request latency increases.

How to Mitigate CVE-2026-57099

Immediate Actions Required

• Apply the security updates referenced in the Microsoft Vulnerability Advisory CVE-2026-57099 to all affected ASP.NET Core deployments.
• Inventory internet-facing ASP.NET Core services and prioritize patching for endpoints exposed to untrusted networks.
• Enable rate limiting, request size limits, and connection throttling on upstream load balancers or reverse proxies.

Patch Information

Microsoft has released fixes as part of its update guide. Consult the Microsoft Vulnerability Advisory CVE-2026-57099 for the specific runtime versions and NuGet package updates that address the vulnerability. Redeploy applications on patched runtimes and verify that self-contained deployments include the updated Microsoft.AspNetCore.* assemblies.

Workarounds

• Configure ASP.NET Core rate limiting middleware to cap concurrent requests per client and per endpoint.
• Enforce MaxRequestBodySize, MaxConcurrentConnections, and Kestrel connection limits to bound per-request resource usage.
• Place vulnerable services behind a WAF or reverse proxy that terminates and validates traffic before it reaches the application.

# Example Kestrel limits in appsettings.json
{
  "Kestrel": {
    "Limits": {
      "MaxConcurrentConnections": 1000,
      "MaxConcurrentUpgradedConnections": 100,
      "MaxRequestBodySize": 10485760,
      "KeepAliveTimeout": "00:02:00",
      "RequestHeadersTimeout": "00:00:30"
    }
  }
}