01 Record
CVE-2026-109468
ASP.NET Core Denial of Service Vulnerability
HighPUBLISHEDCNA: microsoft
CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
02 Description
ASP.NET Core Denial of Service Vulnerability
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- Not scored by EPSS
- EPSS percentile
- Not scored by EPSS
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Not recorded
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-15 20:57Z1 HR AGO
- Last updated
- 2026-10-15 22:20Z13 MIN AGO
- Reserved
- 2026-10-12
- Assigning CNA
- microsoft
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.5)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
- Weaknesses
- CWE-770Allocation of Resources Without Limits or ThrottlingBase
- Data version
- 5.2
- Document digest
- 63765ba1e11bd49bb295d66ccf45173dd09c59cc484591c2c7aeee74b3815df3
05 Affected products
VendorProductVersionsPlatforms
MicrosoftSystem.Formats.Cbor10.0.0 to < 10.0.13.NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, .NET 8.0 installed on Windows, .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, .NET 9.0 installed on Windows
06 References
- msrc.microsoft.comASP.NET Core Denial of Service Vulnerabilityhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109468