CVE-2026-109468 in System-Formats-Cbor
Summary
by MITRE • 10/16/2026
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability described constitutes a classic resource exhaustion flaw within the ASP.NET Core framework, specifically categorized under CWE-770: Allocation of Resources Without Limits or Throttling. This security deficiency arises when the application server fails to impose strict constraints on the quantity of resources that can be consumed by a single client session or connection during its lifecycle. In the context of web applications built with ASP.NET Core, this often manifests in areas such as request body size limits, concurrent connection handling, memory allocation for parsing complex data structures, or thread pool utilization. When these mechanisms are either misconfigured to allow unbounded growth or entirely absent, an attacker can exploit the lack of throttling to systematically deplete system resources.
From a technical perspective, this flaw allows an unauthorized actor to initiate a Denial of Service attack by sending requests that consume disproportionate amounts of memory, CPU cycles, or network bandwidth relative to their size or complexity. For instance, if the framework does not adequately limit the depth of JSON deserialization or the number of items in a collection being processed, an attacker can submit payloads designed to trigger excessive recursive processing or massive array allocations. Similarly, failing to enforce limits on concurrent connections can lead to thread pool starvation, where legitimate users are unable to obtain service because all available threads are occupied by malicious requests waiting for I/O operations that never complete. This behavior aligns with the MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or flood attacks against network services.
The operational impact of this vulnerability is severe and immediate, resulting in a complete loss of availability for legitimate users accessing the ASP.NET Core application. As system resources such as memory (RAM) and CPU are consumed by malicious traffic, the server may become unresponsive, crash, or enter an unstable state requiring manual intervention to restart services. In cloud-native environments where auto-scaling is configured based on resource metrics, this attack can trigger unnecessary scaling events, leading to significant financial costs without resolving the underlying availability issue if the root cause remains unchecked. Furthermore, in multi-tenant architectures, a single compromised tenant or malicious actor could degrade performance for other tenants sharing the same infrastructure, violating service level agreements and damaging organizational reputation.
Mitigation strategies must focus on implementing robust input validation and resource management controls within the ASP.NET Core pipeline. Developers should explicitly configure maximum limits for request body sizes using middleware such as RequestSizeLimit to prevent oversized payloads from consuming excessive memory. It is critical to utilize built-in throttling mechanisms or third-party libraries that enforce rate limiting based on IP address, user identity, or endpoint path to restrict the frequency of requests a single entity can make within a given timeframe. Additionally, configuring appropriate timeouts for all I/O operations ensures that hung connections do not indefinitely occupy server threads. Regular security assessments and load testing should be conducted to identify potential bottlenecks where resource allocation lacks sufficient boundaries, ensuring that the application remains resilient against volumetric and logic-based denial of service attempts.