The vulnerability is a logic flaw that creates an infinite loop in ASP.NET Core, allowing an unauthorized attacker to exhaust system resources and cause a denial of service. This type of flaw falls under CWE-835 (Infinite Loop). The impact is a service outage, potentially affecting all users of the affected application, as the loop continually consumes CPU or memory until the process terminates or the system becomes unresponsive. No data exfiltration or authentication bypass is indicated by the description, so confidentiality and integrity are not directly compromised.

Microsoft .NET 10.0, Microsoft .NET 9.0, and Microsoft .NET 8.0 are affected. The specific affected components are the ASP.NET Core runtime libraries that contain the infinite loop logic. Users of these framework versions should verify whether their deployed applications include the vulnerable code paths.

The CVSS score of 7.5 indicates a high severity for denial of service. EPSS data is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote network access: an unauthorized client can trigger the loop by sending a crafted request. Successful exploitation would result in prolonged service unavailability, which can be exploited in a broader denial-of-service campaign when combined with other vulnerabilities or resource exhaustion attacks.