Microsoft ASP.NET Core: Information disclosure through uninitialized resource
Summary
An uninitialized resource in ASP.NET Core can allow an unauthenticated remote attacker to read response data belonging to another request. According to the advisory summaries, the disclosure is tied to HTTP logging and requires high attack complexity. Impact is limited to confidentiality.
Affected
- Microsoft .NET 11.0 on Linux, macOS and Windows: 11.0.0-preview.1 to before 11.0.0 (start version disputed between sources, see notes)
- Microsoft Visual Studio 2026 version 18.12: affected range unclear in sources
- Unknown: exact MSRC affected-product table and Visual Studio build numbers
Fixed in
- ASP.NET Core / .NET 11.0.0 (per the November 2026 servicing update)
- Unknown: patched Visual Studio 2026 build
Workaround
No workaround documented. Upgrade to 11.0.0 or later.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial
- Rapid7: Exploitation Less Likely, no public disclosure
- Not listed in CISA KEV; no reports of in-the-wild exploitation or public proof of concept found
Our recommendation
- Inventory all .NET 11 preview and pre-11.0.0 installations, including self-contained and Linux-hosted applications
- Update to ASP.NET Core 11.0.0 or later, starting with internet-facing services
- Review whether affected applications log response bodies via HTTP logging and prioritise those systems
- Internal-only systems can be patched in the regular cycle
- .NET 8 and 10 are probably not affected according to the sources; confirm against the MSRC page
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-114150 msrc.microsoft.com
- GitLab Advisory (linux-musl-arm) advisories.gitlab.com
- GitLab Advisory (osx-x64) advisories.gitlab.com
- GitHub dotnet/aspnetcore security advisories github.com
- .NET November 2026 servicing updates devblogs.microsoft.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Strix CVE-2026-114150 www.strix.ai
- Mallory summary CVE-2026-114150 mallory.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:31.
Original description (NVD)
Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.