CVE-2026-56170

ASP.NET Core Denial of Service Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Analysis

Technical impact

ASP.NET Core can allocate resources without limits or throttling, which allows an unauthorized attacker to cause a denial of service across a network. The vulnerability is a classic case of uncontrolled resource consumption, identified as CWE-770. Resulting DoS can render the targeted web application unavailable to legitimate users.

Affected Systems

Microsoft .NET 8.0, 9.0, and 10.0 are impacted. These versions can be found on the Microsoft ".NET" platform and should be evaluated for deployment of any updates or patches. In addition, RedHat Hummingbird version 1 is affected and should receive its corresponding update.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, while the EPSS score of about 1% indicates a low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network-based, where an attacker can send crafted requests to trigger excessive resource consumption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

.NET 10.0 runtime

affected

Version	Status	Constraints
`10.0.0`	affected	< 10.0.10

Microsoft

.NET 8.0 runtime

affected

Version	Status	Constraints
`8.0.0`	affected	< 8.0.29

Microsoft

.NET 9.0 runtime

affected

Version	Status	Constraints
`9.0.0`	affected	< 9.0.18

Configuration 1 [-]

AND

OR	cpe:2.3:a:microsoft:.net::::::::
	cpe:2.3:a:microsoft:.net::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*

Package	CPE	Advisory	Released Date
Red Hat Hardened Images
dotnet10-0-main-10.0.109-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:26638	2026-06-17T00:00:00Z
dotnet9-0-main-9.0.119-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:39952	2026-07-15T00:00:00Z

Vendor Product Versions

Microsoft

.net

Version	Status	Scheme	Platform
`[10.0.0,10.0.10)`	affected	semver	—

Microsoft

.net

Version	Status	Scheme	Platform
`[8.0.0,8.0.29)`	affected	semver	—

Microsoft

.net

Version	Status	Scheme	Platform
`[9.0.0,9.0.18)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Microsoft vendor patch or upgrade to the latest .NET runtime version as outlined in the Microsoft advisory.
Configure application or network level throttling to limit resource allocation per request.
Monitor logs and performance metrics for abnormal consumption patterns that could indicate an attempted DoS attack.
Apply the RedHat Hummingbird update or upgrade to a patched version.

Generated by OpenCVE AI on August 1, 2026 at 09:48 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-j8gr-8fp3-5q5h	Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.2% (1.174% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170
https://nvd.nist.gov/vuln/detail/CVE-2026-56170
https://www.cve.org/CVERecord?id=CVE-2026-56170

History

Jul 18, 2026 12:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat hummingbird
CPEs		cpe:/a:redhat:hummingbird:1
Vendors & Products		Redhat Redhat hummingbird
References		https://nvd.nist.gov/vuln/detail/CVE-2026-56170 https://www.cve.org/CVERecord?id=CVE-2026-56170
Metrics	threat_severity `None`	threat_severity `Important`

Jul 14, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Title		ASP.NET Core Denial of Service Vulnerability
First Time appeared		Microsoft Microsoft .net
Weaknesses		CWE-770
CPEs		cpe:2.3:a:microsoft:.net::::::::
Vendors & Products		Microsoft Microsoft .net
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}`