Description
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Published: 2026-10-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

This vulnerability stems from ASP.NET Core allocating resources without limits or throttling. An unauthorized attacker can send crafted requests over a network to exhaust server resources, leading to a denial of service. The weakness maps to CWE‑770, reflecting uncontrolled resource consumption.

Affected Systems

The affected products are Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, and Microsoft System.Formats.Cbor. No broader version ranges were specified in the CNA data.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote network, where an attacker could trigger the resource exhaustion by sending malicious traffic. Given the lack of mitigation from the CNA, the risk remains high until patched or mitigated.

Generated by OpenCVE AI on October 16, 2026 at 06:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patches or upgrade Microsoft Visual Studio 2022 to version 17.14 or later and Visual Studio 2026 to version 18.10 or later, and update System.Formats.Cbor to the latest release.
  • Configure network traffic controls such as rate limiting or request throttling to reduce the impact of potential denial‑of‑service attempts.
  • Monitor server resource usage for abnormal spikes and investigate any sudden increases in memory or CPU consumption.

Generated by OpenCVE AI on October 16, 2026 at 06:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 15 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Title ASP.NET Core Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft system.formats.cbor
Microsoft visual Studio 2022
Weaknesses CWE-770
CPEs cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:system.formats.cbor:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft system.formats.cbor
Microsoft visual Studio 2022
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Microsoft Visual Studio 2026 Version 18.10 System.formats.cbor Visual Studio 2022
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:01:16.234Z

Reserved: 2026-10-12T17:01:11.370Z

Link: CVE-2026-109468

cve-icon Vulnrichment

Updated: 2026-10-16T01:03:16.050Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T21:17:12.880

Modified: 2026-10-22T22:18:00.613

Link: CVE-2026-109468

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-15T20:57:33Z

Links: CVE-2026-109468 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T06:30:07Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling