The issue is an unbounded resource allocation within ASP.NET Core. An attacker who can reach the application can send crafted requests that cause the framework to consume excessive memory or processing resources, leading to service interruption for legitimate users. The vulnerability maps to CWE‑770 and results in a loss of availability.

Microsoft ASP.NET Core versions 8.0, 9.0, and 10.0 are affected. Additionally, Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10 contain the vulnerable component. Any application built with or running on these products without the patch is at risk.

The CVSS score of 7.5 indicates a high severity. The EPSS score of 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, over a network, requiring the target to expose an ASP.NET Core endpoint. Because no mitigations are forced by default, an attacker can easily trigger the denial by sending a burst of requests until resources are exhausted. If the application runs with elevated privileges, the potential impact could extend beyond availability.