CVE-2026-96236: ASP.NET Core DOS Vulnerability

CVE-2026-96236 Overview

CVE-2026-96236 is a denial-of-service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling [CWE-770]. An unauthorized remote attacker can send crafted requests that force the application to consume unbounded resources, degrading or halting availability. The flaw is reachable over a network, requires no authentication, and no user interaction. Microsoft published the advisory on October 13, 2026.

Critical Impact
Remote, unauthenticated attackers can exhaust ASP.NET Core server resources and deny service to legitimate users.

Affected Products

ASP.NET Core (version details published in the Microsoft Security Update Guide)
Applications built on ASP.NET Core request-processing pipelines
Web services and APIs exposing ASP.NET Core endpoints to untrusted networks

Discovery Timeline

2026-10-13 - CVE-2026-96236 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-96236

Vulnerability Analysis

The vulnerability stems from ASP.NET Core allocating resources without enforcing size, rate, or concurrency limits during request handling. An attacker submits requests designed to trigger disproportionate memory, thread, or CPU consumption on the server. Because the condition is reachable over the network and does not require privileges or user interaction, the attack surface is broad.

Successful exploitation does not disclose data or alter integrity, but it can render the application unresponsive. Workers that cannot free resources quickly enough become backlogged, causing legitimate requests to time out. In containerized or autoscaled environments, repeated exploitation can also trigger cost amplification through unnecessary scale-out events.

Root Cause

The root cause is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. ASP.NET Core request-processing code paths accept input or perform work without applying bounds checks, quotas, or throttling. Attackers abuse this missing control to force the runtime to allocate memory, threads, or connections beyond safe thresholds.

Attack Vector

The attack vector is network-based. An unauthenticated remote attacker sends specially crafted HTTP requests to an exposed ASP.NET Core endpoint. No credentials, user interaction, or prior foothold are required. Exploitation reliability is improved when attackers can parallelize requests against the same vulnerable endpoint.

No verified public proof-of-concept code is available. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-96236

Indicators of Compromise

Sustained spikes in managed memory, thread pool queue length, or garbage collection pressure on ASP.NET Core hosts without a corresponding business workload change.
Repeated HTTP requests from a narrow set of source IPs targeting the same endpoint with unusually large payloads or high concurrency.
Kestrel or IIS worker processes recycling frequently due to memory or connection thresholds.

Detection Strategies

Baseline normal request rates, payload sizes, and resource utilization per endpoint, then alert on statistical deviations.
Correlate web server access logs with host-level CPU, memory, and thread metrics to identify request patterns preceding resource exhaustion.
Inspect application telemetry for abnormally long request durations tied to specific routes or request shapes.

Monitoring Recommendations

Enable ASP.NET Core request logging and forward it, along with Windows or Linux performance counters, into a centralized analytics platform.
Monitor Kestrel connection counts, request queue depth, and HTTP 503 responses as early indicators of resource saturation.
Alert on repeated client IPs that consistently generate top-decile request processing cost.

How to Mitigate CVE-2026-96236

Immediate Actions Required

Apply the Microsoft security update for ASP.NET Core referenced in the Microsoft Security Update Guide as soon as it is validated in a test environment.
Inventory internet-facing ASP.NET Core applications and prioritize patching of those with unauthenticated endpoints.
Place vulnerable services behind a web application firewall or reverse proxy with request-rate limits until patching is complete.

Patch Information

Microsoft has published the fix through the Security Update Guide for CVE-2026-96236. Administrators should consult the advisory for the exact affected ASP.NET Core versions, patched build numbers, and runtime update packages. Rebuild and redeploy self-contained applications after updating the ASP.NET Core shared framework or NuGet package references.

Workarounds

Configure Kestrel request limits such as MaxRequestBodySize, MaxConcurrentConnections, and request header size limits to constrain per-request resource use.
Apply ASP.NET Core rate limiting middleware (AddRateLimiter) to throttle anonymous traffic to sensitive endpoints.
Enforce upstream rate limits, connection caps, and request timeouts at the load balancer, CDN, or WAF layer.
Restrict exposure of non-essential endpoints to trusted networks until the patch is deployed.

bash

# Configuration example: Kestrel limits and rate limiting in ASP.NET Core
# Program.cs
builder.WebHost.ConfigureKestrel(options =>
{
    options.Limits.MaxConcurrentConnections = 1000;
    options.Limits.MaxRequestBodySize = 1_048_576; // 1 MB
    options.Limits.KeepAliveTimeout = TimeSpan.FromSeconds(30);
    options.Limits.RequestHeadersTimeout = TimeSpan.FromSeconds(10);
});

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("anon", o =>
    {
        o.PermitLimit = 60;
        o.Window = TimeSpan.FromMinutes(1);
        o.QueueLimit = 0;
    });
});

var app = builder.Build();
app.UseRateLimiter();