CVE-2026-118749: ASP.NET Core Denial of Service Vulnerability

CVE-2026-118749 PUBLISHED CVSS 7.5 HIGH

ASP.NET Core Denial of Service Vulnerability

Reported by microsoft · Published November 10, 2026

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
aspnetcore	DHI	11.0.0
.NET 11.0 installed on Windows	Microsoft	11.0.0

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	.NET 11.0 installed on Linux	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Mac OS	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Windows	11.0.0-preview.1
Microsoft	Microsoft Visual Studio 2026 version 18.12	18.12.0
Microsoft	Microsoft.Extensions.Validation	11.0.0-rc.1.26425.128
Microsoft	.NET 11.0 installed on Windows	11.0.0-preview.1
microsoft	microsoft_visual_studio_2026_version_18.12	18.12.0
microsoft	.net_11.0_installed_on_windows	11.0.0-preview.1
microsoft	microsoft.extensions.validation	11.0.0-rc.1.26425.128
Microsoft	.NET 11.0 installed on Mac OS	11.0.0-preview.1
Microsoft	.NET 11.0 installed on Linux	11.0.0-preview.1
microsoft	.net_11.0_installed_on_linux	11.0.0-preview.1
Microsoft	Microsoft.Extensions.Validation	11.0.0-rc.1.26425.128
microsoft	.net_11.0_installed_on_mac_os	11.0.0-preview.1
Microsoft	Microsoft Visual Studio 2026 version 18.12	18.12.0

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-118749
vulnetix vdb fixes CVE-2026-118749

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-118749/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart