CVE-2026-57099 in AspNetCore.OData
Summary
by MITRE • 09/08/2026
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described constitutes a classic resource exhaustion flaw within the ASP.NET Core framework, specifically categorized under CWE-770: Allocation of Resources Without Limits or Throttling. This security deficiency arises when the application server fails to impose strict constraints on the quantity of resources that can be consumed by a single client session or connection during its lifecycle. In the context of web applications built with ASP.NET Core, this often manifests in scenarios where input data is processed without size validation, such as file uploads, large JSON payloads, or excessive query parameters. When an attacker sends requests containing disproportionately large amounts of data compared to what the system expects, the server allocates memory and processing power proportional to that input rather than capping it at a predefined threshold. This lack of throttling allows malicious actors to systematically drain available system resources, leading directly to a denial of service condition for legitimate users sharing the same infrastructure.
From an operational perspective, this vulnerability enables remote attackers to disrupt availability without necessarily needing authentication credentials if the affected endpoint is publicly accessible. The attack vector typically involves sending multiple concurrent requests or a single massive request that forces the application server to allocate excessive memory buffers or CPU cycles. As resources are depleted, the server may become unresponsive, crash, or enter into an unstable state where it cannot process new legitimate connections. This impacts not only the specific application running on ASP.NET Core but can also affect other services hosted on the same machine if resource limits like RAM or CPU quotas are shared across processes. The resulting downtime leads to significant business disruption, loss of customer trust, and potential financial losses due to service unavailability.
This type of vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly T1496: Resource Hijacking, where attackers use compromised resources for their own purposes or simply exhaust them to cause harm. It also relates to T1055: Process Injection if the exhaustion leads to memory corruption that could be exploited further, though primarily it is a direct availability attack under the Impact category of Denial of Service. Understanding these mappings helps security teams prioritize remediation efforts based on established threat intelligence and common adversary behaviors rather than treating each instance as an isolated coding error.
Mitigation strategies must focus on implementing robust input validation and resource management policies within the ASP.NET Core pipeline. Developers should enforce strict limits on request body sizes using middleware configurations, such as setting MaxRequestBodySize properties in Kestrel or IIS integration layers. Additionally, employing rate limiting mechanisms can prevent a single IP address from overwhelming the server with too many requests in a short timeframe. Implementing circuit breakers and timeout settings ensures that long-running operations do not hold resources indefinitely. It is also critical to validate all incoming data against expected schemas and sizes before processing begins, ensuring that any oversized inputs are rejected early in the request lifecycle rather than after significant resource allocation has occurred. Regular security testing using load simulation tools can help identify these bottlenecks before they are exploited in production environments.