ASP.NET Core: Denial of service due to inefficient algorithmic complexity
Summary
ASP.NET Core in .NET 8 (and per the CVE record also .NET 9 and Visual Studio 2022/2026) contains an inefficient algorithmic complexity flaw (CWE-407). A remote, unauthenticated attacker can send crafted requests to make the application consume excessive resources and become unavailable. No confidentiality or integrity impact is documented. Exploitation requires no privileges or user interaction, so internet-facing applications are most at risk.
Affected
- Microsoft .NET 8.0 on Linux, macOS and Windows: 8.0.0 to before 8.0.34
- Microsoft .NET 9.0 on Linux, macOS and Windows: 9.0.0 to before 9.0.0-preview.4.24266.19 (per CVE record; Microsoft's servicing post lists .NET 8 only, so verify)
- Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.45
- Visual Studio 2026 version 18.11: 18.11.0 to before 18.11.4
- Visual Studio 2026 version 18.12: range in the CVE record is unclear; verify on the MSRC page
Fixed in
- .NET 8.0.34 (per Microsoft servicing information and OffSeq)
- Visual Studio 2022 17.14.45
- Visual Studio 2026 18.11.4
- Fixed version for Visual Studio 2026 18.12: Unknown.
- Fixed version for .NET 9: Unknown; check the MSRC advisory.
Workaround
Unknown. No vendor-documented interim mitigation was found; apply the security update.
Exploitation
- Microsoft's Exploitability Index and CISA SSVC: no exploitation known (SSVC: Exploitation none, Automatable yes).
- Rapid7 rates exploitation as 'Less Likely' and lists the CVE as not publicly disclosed.
- One tracker (OffSeq) mentions honeypot observations with unclear wording; this is unverified.
- No public proof of concept found.
Our recommendation
- Inventory all .NET 8 and .NET 9 runtimes, SDKs, Visual Studio installations and self-contained applications.
- Patch internet-facing ASP.NET Core services first, then internal ones.
- Update NuGet packages and Linux container images, not only the runtime; check the per-CVE advisory.
- Verify the .NET 8 end-of-support date on Microsoft's lifecycle page; if it has passed, plan migration to a supported .NET release.
- Monitor for abnormal resource usage and request volume on web applications and APIs.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Denial of service – ASP.NET Core
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Developer tools (.NET, Visual Studio …)
- Updates (KB)
- KB5135243
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-109478 msrc.microsoft.com
- CVE.org record CVE-2026-109478 www.cve.org
- Microsoft .NET November 2026 servicing updates devblogs.microsoft.com
- dotnet/announcements issue 504 (consolidated November announcement) github.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Senserva KB 5135243 senserva.com
- OffSeq Radar: CVE-2026-109478 radar.offseq.com
- Windows Forum: .NET 8 and 9 end of support windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:03.
Original description (NVD)
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.