CVE-2026-70196 in ASP.NET Core
Summary
by MITRE • 10/14/2026
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves inefficient algorithmic complexity within the ASP.NET Core framework, which presents a significant risk of denial-of-service attacks when exploited by unauthorized actors. This type of flaw is fundamentally rooted in how the application processes specific inputs or requests that trigger computationally expensive operations without adequate bounds checking or optimization. When an attacker sends specially crafted HTTP requests to a vulnerable endpoint, the server may enter into a state where it consumes excessive CPU resources or memory while attempting to process these malformed or complex payloads. This resource exhaustion prevents legitimate users from accessing services, effectively causing a denial of service condition that disrupts business operations and degrades system availability.
From a technical perspective, this issue aligns with CWE-400, which classifies uncontrolled resource consumption due to inefficient algorithmic complexity. The flaw typically arises when the framework fails to limit the depth or size of recursive processes, string manipulations, or data parsing routines that are triggered by user-supplied input. For instance, if a serializer or parser does not properly validate the structure of incoming JSON or XML documents before processing them, an attacker can craft deeply nested structures or excessively large inputs that cause the application to hang or crash during execution. This behavior is particularly dangerous in web applications because it allows remote exploitation over standard network protocols without requiring authentication, making it a high-severity threat vector for public-facing services.
The operational impact of this vulnerability extends beyond simple service interruption. In cloud-native environments where resources are dynamically allocated based on demand, such attacks can lead to significant financial costs as auto-scaling mechanisms may spin up additional instances in response to the perceived spike in traffic caused by the attack requests. Furthermore, prolonged exposure to these conditions can cause cascading failures across dependent microservices or databases that rely on timely responses from the ASP.NET Core application. Security teams must recognize this not merely as a performance issue but as a critical availability risk that requires immediate remediation through code review and architectural adjustments.
To mitigate this vulnerability, developers should implement strict input validation and sanitization routines to reject overly complex or large payloads before they reach processing logic. Utilizing built-in rate limiting features in ASP.NET Core can help throttle requests from single sources, reducing the impact of volumetric attacks. Additionally, setting explicit limits on recursion depth, string length, and JSON/XML parsing complexity ensures that the application fails fast with a clear error message rather than consuming unlimited resources. Regular security testing using static analysis tools and dynamic penetration tests focused on resource exhaustion scenarios is essential to identify such inefficiencies early in the development lifecycle.
This vulnerability maps directly to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service or Network Denial of Service depending on the deployment context, where adversaries aim to disrupt availability by overwhelming system resources. By addressing the underlying algorithmic inefficiency and enforcing robust input constraints, organizations can significantly reduce their attack surface against denial-of-service exploits targeting ASP.NET Core applications.