CVE-2026-114149: ASP.NET Core Denial of Service Vulnerability

CVE-2026-114149 PUBLISHED CVSS 7.5 HIGH

ASP.NET Core Denial of Service Vulnerability

Reported by microsoft · Published November 10, 2026

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	.NET 10.0 installed on Linux	10.0.0
Microsoft	.NET 10.0 installed on Mac OS	10.0.0
Microsoft	.NET 10.0 installed on Windows	10.0.0
Microsoft	.NET 11.0 installed on Linux	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Mac OS	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Windows	11.0.0-preview.1
Microsoft	.NET 8.0 installed on Linux	8.0.0
Microsoft	.NET 8.0 installed on Mac OS	8.0.0
Microsoft	.NET 8.0 installed on Windows	8.0.0
Microsoft	.NET 9.0 installed on Linux	9.0.0
Microsoft	.NET 9.0 installed on Mac OS	9.0.0
Microsoft	.NET 9.0 installed on Windows	9.0.0
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0
Microsoft	Microsoft Visual Studio 2026 version 18.11	18.11.0
Microsoft	Microsoft Visual Studio 2026 version 18.12	18.12.0
Microsoft	Microsoft.AspNetCore.WebUtilities	2.3.12
microsoft	.net_11.0_installed_on_mac_os	11.0.0-preview.1
microsoft	microsoft_visual_studio_2026_version_18.11	18.11.0
Microsoft	.NET 9.0 installed on Mac OS	9.0.0
Microsoft	.NET 8.0 installed on Mac OS	8.0.0

…and 29 more

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-114149
vulnetix vdb fixes CVE-2026-114149

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-114149/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart