Microsoft Security Advisory CVE-2026-118748 - ASP.NET Core Denial of Service Vulnerability

🗓️ 11 Nov 2026 00:11:03Reported by GitHub Advisory DatabaseType

Remote DoS in ASP.NET Core Blazor static-SSR via rendered field names in a singleton cache.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-118748	10 Nov 202612:38	–	circl
CVE	CVE-2026-118748	10 Nov 202618:21	–	cve
Cvelist	CVE-2026-118748 ASP.NET Core Denial of Service Vulnerability	10 Nov 202618:21	–	cvelist
EUVD	EUVD-2026-122254	11 Nov 202600:11	–	euvd
Microsoft CVE	ASP.NET Core Denial of Service Vulnerability	10 Nov 202616:00	–	mscve
NCSC	Vulnerabilities fixed in Microsoft Developer Tools	10 Nov 202619:38	–	ncsc
NVD	CVE-2026-118748	10 Nov 202619:19	–	nvd
osv_ghsa	GHSA-5H82-77P6-2WP3 Microsoft Security Advisory CVE-2026-118748 - ASP.NET Core Denial of Service Vulnerability	11 Nov 202600:11	–	osv_ghsa
Rapid7 Vulnerability Database (full)	CVE-2026-118748: Microsoft: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service…	10 Nov 202600:00	–	rapid7
RedhatCVE	CVE-2026-118748	10 Nov 202622:01	–	redhatcve

Vulners

Node

microsoft aspnetcore.app.runtime.win-x86Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.win-x64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.win-arm64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.osx-x64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.osx-arm64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.linux-x64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.linux-musl-x64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.linux-musl-arm64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.linux-musl-armRange11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.linux-arm64Range11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

microsoft aspnetcore.app.runtime.linux-armRange11.0.0-preview.7.26381.103–11.0.0-rc.3.26522.148nuget

Source	Link
github	www.github.com/dotnet/aspnetcore/security/advisories/GHSA-5h82-77p6-2wp3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-118748
github	www.github.com/dotnet/announcements/issues/516
github	www.github.com/dotnet/aspnetcore/discussions/70477
github	www.github.com/dotnet/aspnetcore/releases/tag/v11.0.0
github	www.github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118748
github	www.github.com/advisories/GHSA-5h82-77p6-2wp3

11 Nov 2026 00:11Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5