CVE-2026-70159 in ASP.NET Core
Summary
by MITRE • 10/14/2026
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical flaw within the ASP.NET Core framework, specifically concerning how it manages and allocates system resources during request processing. This issue falls under the category of Uncontrolled Resource Consumption, which is formally classified as CWE-770 in the Common Weakness Enumeration database. The core technical deficiency lies in the absence of effective throttling mechanisms or strict limits on resource allocation for incoming network requests. When an application fails to enforce boundaries on memory usage, CPU cycles, or connection counts per request, it becomes susceptible to exploitation by malicious actors seeking to exhaust available system capacity. In a production environment, this lack of control means that the server does not adequately restrict the amount of resources any single client can consume during their interaction with the web application.
An unauthorized attacker can exploit this weakness by sending a high volume of requests or crafting specific payloads designed to trigger resource-intensive operations within ASP.NET Core without triggering appropriate rate-limiting controls. This behavior leads directly to a Denial of Service condition, where legitimate users are unable to access services because system resources such as memory and processing power are fully consumed by the malicious traffic. From an offensive security perspective, this aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically under sub-techniques that involve resource exhaustion through application-layer attacks rather than volumetric network flooding. The attacker does not need to compromise authentication credentials; they simply leverage the open nature of the service and its inability to cap resource usage per session or IP address.
The operational impact of this vulnerability is severe for any organization relying on ASP.NET Core for hosting critical web services. A successful exploitation can result in complete unavailability of the application, leading to significant business disruption, loss of revenue, and damage to reputation. Furthermore, if the underlying infrastructure shares resources with other critical systems, the exhaustion caused by one vulnerable service could potentially cascade into broader system instability. The lack of throttling means that even a single determined attacker can degrade performance significantly or cause total outages depending on the scale of resource consumption triggered by their requests.
To mitigate this risk, developers and security engineers must implement robust request handling policies within ASP.NET Core applications. This includes configuring rate limiting middleware to restrict the number of requests allowed from a specific client over a given time window. Additionally, setting explicit limits on memory allocation for incoming data streams, such as maximum body size configurations, is essential to prevent large payload attacks that consume excessive heap space. It is also advisable to utilize reverse proxies like Nginx or Azure Application Gateway in front of the ASP.NET Core application to handle initial traffic filtering and load balancing before requests reach the vulnerable framework layer. Regular security audits focusing on resource management patterns and adherence to secure coding standards will further reduce the likelihood of such vulnerabilities persisting in production environments.