The vulnerability involves uncontrolled resource allocation in ASP.NET Core, enabling an unauthorized attacker to exhaust server resources and cause denial of service over the network. This corresponds to CWE‑770 resource exhaustion and could bring an application or host offline.

Affected vendors include Microsoft, specifically Visual Studio 2022 version 17.14, Visual Studio 2026 version 18.10, and the ASP.NET Core SignalR Common and Core libraries. Versions before these releases are vulnerable and any ASP.NET Core application that uses these components without proper throttling is at risk.

The CVSS score of 7.5 indicates a high impact severity, while the EPSS score of 1% signals a low but nonzero exploitation probability, suggesting that although the vulnerability is severe, the likelihood of widespread exploitation is modest. The vulnerability is not listed in CISA KEV catalog, indicating no known widespread exploits yet, but the ability to trigger denial of service via unauthenticated network requests warrants prompt remediation.