CVE-2026-96236 in ASP.NET Core
Summary
by MITRE • 10/15/2026
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability described involves a critical flaw within the ASP.NET Core framework, specifically concerning how it manages and allocates system resources during request processing. This issue falls under the category of Improper Limitation of a Resource by Entity, commonly referenced as CWE-400 in industry standards. The core technical deficiency lies in the absence of adequate throttling mechanisms or resource caps for incoming network requests. When an application built on ASP.NET Core processes HTTP traffic, it may allocate memory buffers, thread pool slots, or other computational resources without verifying whether these allocations are within sustainable limits relative to system capacity. This lack of enforcement allows a single client or a coordinated group of clients to consume disproportionate amounts of server resources by sending high volumes of requests or large payloads that trigger excessive resource consumption during parsing and handling phases.
From an operational perspective, this flaw enables a classic Denial of Service attack vector. An unauthorized attacker can exploit the unthrottled allocation mechanism to exhaust available memory, CPU cycles, or network bandwidth on the hosting server. As resources are consumed faster than they can be reclaimed by the garbage collector or released back to the pool, the application becomes increasingly sluggish and eventually unresponsive. This results in a complete service outage for legitimate users who rely on the ASP.NET Core application for their business operations. The impact is particularly severe because it does not require authentication; any external actor with network access can trigger this state of resource exhaustion simply by interacting with exposed endpoints, making it an attractive target for automated botnets or malicious actors seeking to disrupt service availability without needing prior credentials.
This vulnerability aligns closely with the MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques related to resource exhaustion via application layer attacks. It also relates to CWE-770, Allocation of Resources Without Limits or Throttling, which highlights the failure to implement controls that restrict the amount of resources a single entity can consume over time. The exploitation typically occurs at the web server level where incoming requests are queued and processed. If the framework does not enforce limits on concurrent connections, request body size, or processing duration per thread, an attacker can flood the system with traffic that forces the underlying operating system to swap memory or kill processes, leading to a crash or severe degradation of performance metrics such as latency and throughput.
Mitigation strategies must focus on implementing robust rate limiting and resource management policies at both the application and infrastructure levels. Developers should utilize ASP.NET Core middleware designed for request throttling, such as those provided by libraries like AspNetCoreRateLimit, which allow configuration of sliding window counters or fixed window algorithms to restrict the number of requests a client can make within a specific timeframe. Additionally, configuring Kestrel server limits is essential; this includes setting maximum concurrent connections, limiting header sizes, and defining request body size constraints to prevent large payload attacks. Infrastructure-level protections such as Web Application Firewalls should also be deployed to detect and block abnormal traffic patterns indicative of resource exhaustion attempts before they reach the application layer. Regular load testing and stress analysis are recommended to identify potential bottlenecks and ensure that resource allocation mechanisms scale appropriately under peak loads without compromising system stability or availability for legitimate users.