CVE-2026-45591: ASP.NET Core Denial of Service Vulnerability

Synopsis

Uncontrolled resource consumption in ASP.NET Core (affecting .NET 8.0, 9.0, and 10.0, plus Visual Studio 2026 version 18.6) allows a remote, unauthenticated attacker to exhaust server resources over the network. No authentication or user interaction is needed to trigger the flaw. Successful exploitation crashes or freezes the affected service, causing a denial of service. Patched-image rebuilds at versions 8.0.28, 9.0.17, 10.0.9, and 18.6.3 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the ASP.NET Core service over the network; the vulnerability is exposed on any internet- or intranet-facing endpoint running an affected version.

• AuthenticationNot required

  No account or session credential is needed; the attacker can trigger resource exhaustion as an anonymous, unauthenticated caller.

• Victim interactionNot required

  No user action is required; the attacker initiates the attack entirely without any participation from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental setup to land consistently.

Blast Radius

• The targeted ASP.NET Core process exhausts available memory, CPU, or connection-pool resources and becomes unresponsive to legitimate requests.
• All users of the affected service lose access for the duration of the attack, resulting in full service disruption.
• Where multiple services share the same host or process pool, resource exhaustion may degrade or take down adjacent workloads on that host.