CVE-2026-69304: ASP.NET Core DOS Vulnerability

CVE-2026-69304 Overview

CVE-2026-69304 is a denial of service vulnerability in ASP.NET Core caused by improper handling of highly compressed data. An unauthenticated remote attacker can send specially crafted compressed payloads that expand dramatically once decompressed, exhausting server resources. Microsoft published the advisory on September 8, 2026, and the issue is tracked under CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).

The flaw affects availability only. It does not expose data or allow code execution, but it can take web applications offline with minimal attacker effort once a viable request pattern is identified.

Critical Impact
Remote attackers can trigger resource exhaustion in ASP.NET Core services without authentication, degrading or halting application availability.

Affected Products

ASP.NET Core (specific supported versions listed in the Microsoft advisory)
Web applications and APIs built on ASP.NET Core that accept compressed request payloads
Services exposing endpoints that decompress client-supplied content

Discovery Timeline

2026-09-08 - CVE-2026-69304 published to NVD
2026-09-08 - Microsoft advisory released via MSRC
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-69304

Vulnerability Analysis

The vulnerability is a classic data amplification (decompression bomb) weakness. ASP.NET Core accepts compressed request content and decompresses it without adequately bounding the expanded output size or the resources consumed during decompression. An attacker submits a small compressed payload that expands to a much larger buffer in memory, forcing excessive allocations and CPU usage.

Repeated or concurrent requests amplify the effect across worker threads, driving the host process toward memory exhaustion or unresponsiveness. Because the attack requires no credentials and travels over normal HTTP, it fits any internet-exposed ASP.NET Core endpoint that processes compressed input.

The attack complexity is elevated because the attacker must identify an endpoint that accepts and decompresses attacker-controlled content and shape a payload that maximizes expansion. Once found, the technique is reliable and low-bandwidth.

Root Cause

The root cause is missing enforcement of decompression limits. The framework does not consistently cap the ratio between compressed input size and decompressed output, nor does it fail fast when that ratio crosses a safe threshold. This maps directly to CWE-409.

Attack Vector

The attack vector is network-based. An attacker sends HTTP requests with headers such as Content-Encoding: gzip, deflate, or br carrying a crafted archive that expands by several orders of magnitude. The target application decompresses the body during model binding or middleware processing, consuming memory and CPU until the process degrades or crashes. No user interaction and no authentication are required.

Refer to the Microsoft Security Response Center advisory for the specific request patterns and affected code paths.

Detection Methods for CVE-2026-69304

Indicators of Compromise

Inbound HTTP requests with small Content-Length values but Content-Encoding headers indicating compression, followed by sharp memory spikes in the ASP.NET Core worker process.
Sudden increases in w3wp.exe or dotnet.exe memory and CPU consumption correlated with specific client IP addresses.
Repeated request timeouts, HTTP 503 responses, or process recycles on endpoints that accept compressed request bodies.

Detection Strategies

Instrument middleware to log the ratio of decompressed bytes to compressed bytes per request and alert on anomalous ratios.
Monitor Kestrel and IIS logs for bursts of compressed POST/PUT requests from a single source targeting the same endpoint.
Correlate application performance counters (working set, GC pressure) with request telemetry to identify amplification attempts.

Monitoring Recommendations

Ingest ASP.NET Core request telemetry and host process metrics into a centralized analytics platform for cross-signal correlation.
Baseline normal compressed request volume per endpoint and alert on deviations.
Track exception telemetry for OutOfMemoryException and decompression-related errors as leading indicators of exploitation attempts.

How to Mitigate CVE-2026-69304

Immediate Actions Required

Apply the ASP.NET Core security update referenced in the Microsoft advisory to all affected hosts.
Inventory public-facing ASP.NET Core services and identify endpoints that accept compressed request bodies.
Restrict maximum request body size and enforce decompression limits in Kestrel and middleware configuration.

Patch Information

Microsoft has published the fix through the MSRC update guide for CVE-2026-69304. Administrators should install the corresponding .NET runtime and ASP.NET Core shared framework updates for all supported versions in use, then restart affected application pools and services. Consult the MSRC advisory for the authoritative list of patched versions.

Workarounds

Disable request decompression middleware on endpoints that do not require it.
Enforce strict MaxRequestBodySize limits and reject requests whose declared or observed decompressed size exceeds a safe threshold.
Terminate TLS and inspect compressed payloads at a reverse proxy or Web Application Firewall configured to block decompression bombs.
Rate-limit clients that submit compressed payloads to reduce concurrent amplification impact.

bash

# Example: constrain request body size in ASP.NET Core (Program.cs)
# Consult Microsoft documentation for version-specific guidance.
builder.WebHost.ConfigureKestrel(options =>
{
    options.Limits.MaxRequestBodySize = 1_048_576; // 1 MB
});