ASP.NET Core DoS vulnerability CVE-2026-70181 allows unauthenticated memory exhaustion in versions 8, 9 and 10

Microsoft has released security updates to address a high-severity denial of service vulnerability in ASP.NET Core, identified as CVE-2026-70181. The flaw resides in the Microsoft.AspNetCore.WebUtilities component and affects applications running on Windows, Linux and macOS across all architectures. Environments using vulnerable package versions are exposed to remote exploitation without authentication.

Root cause

The vulnerability stems from how FileBufferingReadStream handles multipart processing. According to the GitHub advisory, this component eagerly rents buffers without implementing limits or throttling. This behaviour allows an attacker to force the application to allocate resources without restriction. Consequently, the process can exhaust available memory, leading to a denial of service condition for the affected system.

Attack path

An unauthorised attacker can trigger this flaw over a network. The Microsoft Security Update Guide states that the issue allows an attacker to deny service by exploiting the allocation of resources without limits. No user interaction or authentication is required to initiate the attack. The CVSS score of 7.5 reflects the ease of access and the high impact on availability.

Affected versions

The following package versions are vulnerable and require immediate attention:

• Microsoft.AspNetCore.App.Runtime versions 8.0.0 through 8.0.31 are affected; patched in 8.0.32.
• Microsoft.AspNetCore.App.Runtime versions 9.0.0 through 9.0.20 are affected; patched in 9.0.21.
• Microsoft.AspNetCore.App.Runtime versions 10.0.0 through 10.0.12 are affected; patched in 10.0.13.

Mitigation

• Update all instances of Microsoft.AspNetCore.App.Runtime to the patched versions listed above.
• Verify that deployment pipelines enforce minimum version constraints for these packages.
• Monitor application logs for signs of memory exhaustion during multipart request processing.

Signals worth monitoring

Teams usually observe rising memory usage metrics on web servers during active exploitation. Check whether application logs show repeated multipart processing errors or buffer allocation warnings. Look for sudden drops in request throughput without corresponding increases in legitimate traffic volume. Review network alerts for sustained connections from single sources sending large payloads. Confirm that monitoring tools capture process-level resource consumption to identify abnormal growth patterns early.

Background: CVSS score

A CVE is a unique identifier for a specific security flaw, acting like a name tag. A CVSS score is a numerical rating of that flaw’s severity. You use the CVE to find the issue and the CVSS score to decide how urgently you must fix it. They serve different functions in your workflow.

Read the full guide: Difference Between CVE and CVSS Score: How to Priorise Remediation

What to do and how to stay safe: Microsoft

• Inventory all servers running ASP.NET Core to identify versions 8.0.31, 9.0.20 and 10.0.12.
• Apply the latest runtime updates to move to 8.0.32, 9.0.21 or 10.0.13 respectively.
• Review multipart upload configurations to enforce size limits where possible.
• Monitor system memory usage for anomalies following the update deployment.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-70181?

The CVSS 3.1 score is 7.5, which is rated as high severity.

Which component contains the vulnerability?

The vulnerability is in the Microsoft.AspNetCore.WebUtilities component.

Is authentication required to exploit this flaw?

No, the advisory states that an unauthorised attacker can exploit it over a network.