Résumé
Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability
Détails de l’avis
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Localization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
ASP.NET Core request-localization fallback can add attacker-supplied synthetic culture names to the runtime's global cache, allowing unauthenticated requests to cause unbounded memory growth and denial of service.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/484
CVSS Details
Version: 3.1
Severity: High
Score: 7.5
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness: CWE-770 (Allocation of Resources Without Limits or Throttling)
Affected Platforms
- Platforms: Windows, Linux, macOS
- Architectures: All
Affected Packages
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- MEDIUMCVE-2026-100350
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
- MEDIUMCVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
- HIGHCVE-2026-104827
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
- HIGHCVE-2026-77622
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
- HIGHCVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion