ASP.NET Core: Denial of service through multipart form header processing
Summary
ASP.NET Core in .NET 8 to 11 does not enforce the configured header-count limit when processing multipart form data, which leads to uncontrolled resource consumption (CWE-770). An unauthenticated remote attacker can send crafted multipart requests to exhaust resources and make the affected application unavailable. No user interaction or credentials are required, and the impact is limited to availability. Microsoft reports no known exploitation and no public proof of concept was found.
Affected
- Microsoft .NET 8.0 before 8.0.34 (Windows, Linux, macOS)
- Microsoft .NET 9.0 before 9.0.23 (Windows, Linux, macOS)
- Microsoft .NET 10.0.0 to before 10.0.15 (Windows, Linux, macOS)
- Microsoft .NET 11.0.0-preview.1 to before 11.0.0 (Windows, Linux, macOS)
- Visual Studio 2022 version 17.14 before 17.14.45
- Visual Studio 2026 version 18.11 before 18.11.4
- Visual Studio 2026 version 18.12: affected range in the CVE record is empty, so the exact status is unknown.
Fixed in
- .NET 8.0.34
- .NET 9.0.23
- .NET 10.0.15
- .NET 11.0.0
- Visual Studio 2022 17.14.45 and Visual Studio 2026 18.11.4 (per CVE record)
- Visual Studio 2026 18.12: Unknown.
Workaround
Unknown. No official workaround or mitigation has been published; patching is the only documented remedy.
Exploitation
- Exploited in the wild: No (per Senserva).
- Exploitation likelihood: rated 'Exploitation Less Likely' by Rapid7.
- Public proof of concept: none found, which does not prove that none exists.
- Reported by n0irx (credited by Microsoft).
Our recommendation
- Inventory all .NET runtimes and SDKs, including self-contained applications that bundle their own runtime.
- Update to .NET 8.0.34, 9.0.23, 10.0.15 or 11.0.0 or later, then restart and redeploy the applications.
- Update Visual Studio 2022 and 2026 to a build that contains the fix.
- Prioritise internet-facing ASP.NET Core applications and APIs that accept multipart form uploads.
- Monitor for availability problems and rate-limit untrusted clients as a temporary measure, not as a fix.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide msrc.microsoft.com
- CVE Record CVE-2026-114149 www.cve.org
- .NET November 2026 servicing updates devblogs.microsoft.com
- Microsoft .NET advisory (announcements issue 511) github.com
- ASP.NET Core fix pull request 70444 github.com
- GitLab advisory mirror CVE-2026-114149 advisories.gitlab.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Senserva CVE-2026-114149 (KB) senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:48.
Original description (NVD)
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.