ASP.NET Core: Denial of service due to missing memory release

Summary

ASP.NET Core, the web framework of the .NET platform, contains a flaw in which resources are not released (CWE-401). An unauthenticated attacker on the network can exhaust resources and make affected services unavailable. According to the CVSS vector, only availability is impacted, not confidentiality or integrity. The Microsoft CVE record lists Windows installations of .NET 8, 9 and 10, Visual Studio builds and the Microsoft.AspNetCore.Server.HttpSys package.

Affected

• Microsoft .NET 10.0 on Windows: 10.0.0 to before 10.0.15
• Microsoft .NET 8.0 on Windows: 8.0.0 to before 8.0.34
• Microsoft .NET 9.0 on Windows: 9.0.0 to before 9.0.23
• Microsoft Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.45
• Microsoft Visual Studio 2026 version 18.11: 18.11.0 to before 18.11.4
• Microsoft Visual Studio 2026 version 18.12: 18.12.0 (affected range in the CVE record is empty, unverified)
• Microsoft.AspNetCore.Server.HttpSys: 2.3.10 to before 2.3.14
• Platform scope: Windows according to the Microsoft record; third-party trackers also list Linux and macOS, which is unconfirmed

Fixed in

• Microsoft .NET 8.0: 8.0.34
• Microsoft .NET 9.0: 9.0.23
• Microsoft.AspNetCore.Server.HttpSys: 2.3.14
• Microsoft .NET 10.0: 10.0.15 (derived from the CVE record, unverified)
• Visual Studio 2022 17.14, 2026 18.11 and 2026 18.12: fixed builds unverified, check the Microsoft advisory

Workaround

Unknown.

Exploitation

• No evidence of active exploitation found at the time of research.
• Rapid7 rates exploitation as less likely and reports no public disclosure.
• No public proof of concept found; this does not prove that none exists.
• Not listed in the CISA KEV catalog according to a third-party tracker; not checked directly.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

• Inventory .NET 8, 9 and 10 runtimes, SDKs, Visual Studio installations and ASP.NET Core applications, including NuGet package references.
• Patch internet-facing Windows hosts with ASP.NET Core workloads first, including IIS and HttpSys-based services.
• Update the runtime and the application's NuGet packages; a runtime update alone may not update standalone package references.
• Confirm the fixed versions for .NET 10 and Visual Studio in the Microsoft advisory before rollout.
• Monitor memory use and service availability on affected systems to detect attacks; this does not replace patching.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-114154 msrc.microsoft.com
• GitHub dotnet/announcements #513 github.com
• GitHub dotnet/announcements #504 github.com
• Microsoft .NET Blog: November 2026 servicing updates devblogs.microsoft.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Strix: CVE-2026-114154 www.strix.ai
• Senserva KB5135243 senserva.com
• Mallory: CVE-2026-114154 summary mallory.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:48.