The vulnerability in ASP.NET Core is caused by the allocation of resources without limits or throttling, which allows an unauthorized attacker to deny service over a network. This creates a high‑impact denial of service scenario stemming from a resource exhaustion weakness identified as CWE‑770.

Affected products are Microsoft ASP.NET Core 8.0, 9.0, and 10.0. The flaw applies to all these framework versions and, by extension, any web applications built on them that do not implement their own resource limits.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of 2% suggests a relatively low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would occur remotely via the network, where an attacker sends crafted requests to the application, causing sustained resource consumption that leads to service unavailability. No specific authentication or privileged access is required, and the attack vector requires only network connectivity to the vulnerable endpoints.