A flaw in ASP.NET Core allows an unauthorized attacker to allocate an uncontrolled amount of server resources, resulting in service unavailability over the network. This denial of service is driven by an unthrottled resource allocation process, which can exhaust memory or CPU on the target host. The weakness is a classic example of resource exhaustion, classified under CWE‑770, and can be triggered without user authentication.

Microsoft ASP.NET Core builds 8.0 through 11.0 are impacted, as are Microsoft Visual Studio 2022 v17.14 and Microsoft Visual Studio 2026 v18.10. The CVE does not specify narrower version ranges beyond these product families, so any deployment of the listed ASP.NET Core or Visual Studio releases should be treated as potentially vulnerable.

The advisory assigns a CVSS score of 7.5, indicating a high severity and a high likelihood of significant impact in a suitable environment. The EPSS score indicates a 1% exploitation probability, but the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no already‑known public exploitation. Attackers can launch the exploit remotely and, because it does not require privileged access, can be used to bring services to a halt; mitigation relies on limiting resource use and applying vendor updates.