Description
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Published: 2026-10-13
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Update
AI Analysis

Impact

An inefficient algorithmic complexity in ASP.NET Core enables an unauthorized attacker to disrupt the availability of the application by sending specially crafted requests. The vulnerability causes the platform to consume excessive resources, resulting in denial of service. This impact is restricted to availability, with no direct confidentiality or integrity compromise.

Affected Systems

Microsoft ASP.NET Core versions 10.0, 9.0, and 8.0 are affected. The vulnerability also impacts Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10.

Risk and Exploitability

The CVSS score of 5.9 classifies the vulnerability as moderate. The EPSS score is not available, and the issue is not listed in CISA KEV. Attackers can exploit the flaw from a network standpoint; no elevated privileges are required, and the exploit path is straightforward via crafted network traffic. The overall risk is moderate, and patching is recommended to avoid availability disruption.

Generated by OpenCVE AI on October 14, 2026 at 02:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Microsoft ASP.NET Core to a version that contains the vendor‐issued fix
  • Update Microsoft Visual Studio 2022 and 2026 to the latest patch releases
  • Implement application‑level rate limiting or traffic filtering to mitigate the impact of high‑load request patterns

Generated by OpenCVE AI on October 14, 2026 at 02:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-57xr-hfxx-jw5x Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability
History

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 14 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Title ASP.NET Core Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft asp.net Core
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft visual Studio 2022
Weaknesses CWE-407
CPEs cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft asp.net Core
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft visual Studio 2022
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:06:17.065Z

Reserved: 2026-08-03T23:48:30.861Z

Link: CVE-2026-70196

cve-icon Vulnrichment

Updated: 2026-10-13T22:12:29.810Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:19:33.673

Modified: 2026-10-13T23:17:59.887

Link: CVE-2026-70196

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-13T17:00:00Z

Links: CVE-2026-70196 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T02:30:17Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity