GHSA-57XR-HFXX-JW5X Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Incrementally arriving form...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.osx-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FormPipeRead...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FormPipeReader process. An attacker can exhaust CPU resources by sending incrementally arriving form data that causes repeated rescanning of the buffered body, leading to significant performanc...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.win-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FormPipeRead...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FormPipeRead...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.win-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the FormPipeRead...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.linux-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.linux-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.linux-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...

Inefficient Algorithmic Complexity

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_0827)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20220827 advisory. dotnet: ASP.NET Denial of Service via FormPipeReader CVE-2022-24464 dotnet: double parser stack buffer overrun CVE-2022-24512 brotli: buffer overflow when...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc Multiple Vulnerabilities (crlsa-2022_0826)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20220826 advisory. dotnet: ASP.NET Denial of Service via FormPipeReader CVE-2022-24464 dotnet: double parser stack buffer overrun CVE-2022-24512 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-5.0 / aspnetcore-targeting-pack-5.0 / etc Multiple Vulnerabilities (crlsa-2022_0830)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20220830 advisory. dotnet: ASP.NET Denial of Service via FormPipeReader CVE-2022-24464 dotnet: double parser stack buffer overrun CVE-2022-24512 brotli: buffer overflow when...

MiracleLinux 8 : dotnet6.0-6.0.103-4.el8.ML.1 (AXSA:2022-3100:05)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3100:05 advisory. dotnet: ASP.NET Denial of Service via FormPipeReader CVE-2022-24464 dotnet: double parser stack buffer overrun CVE-2022-24512 Tenable has extracted...

RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:0829)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0829 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

RHEL 7 : .NET 5.0 on RHEL 7 (RHSA-2022:0828)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0828 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...