CVE-2026-26130

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected packages (13)

• Bitnami/aspnet-core>= 8.0.0, < 8.0.25, >= 9.0.0, < 9.0.14, >= 10.0.0, < 10.0.4
• NuGet/Microsoft.AspNetCore.App.Runtime.linux-arm>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.linux-arm64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.linux-musl-arm>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.linux-musl-x64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.linux-x64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.osx-arm64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.osx-x64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.win-arm>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.win-arm64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.win-x64>= 8.0.0, < 8.0.25
• NuGet/Microsoft.AspNetCore.App.Runtime.win-x86>= 8.0.0, < 8.0.25

CVSS scores

References (5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-26130
• PATCHhttps://github.com/dotnet/aspnetcore
• WEBhttps://github.com/dotnet/aspnetcore/security/advisories/GHSA-4vgm-c2wm-63mw
• WEBhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130
• WEBhttps://www.cve.org/CVERecord?id=CVE-2026-26130