CVE-2026-70175

ASP.NET Core Elevation of Privilege Vulnerability

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 16 more

CVE-2021-43877

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Visual Studio 2019 Visual Studio 2022

CVE-2021-34532

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Microsoft Redhat

Products

Asp.net Core Visual Studio 2019 Enterprise Linux and 1 more

CVE-2026-96236

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-88092

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022 and 1 more

CVE-2026-70188

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70196

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70186

ASP.NET Core Denial of Service Vulnerability

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70183

ASP.NET Core Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70181

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-57099

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.asp.netcore .asp.netcore Asp.net Core Odata

CVE-2026-69304

ASP.NET Core Denial of Service Vulnerability

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Asp.net Core Microsoft Visual Studio 2022 and 4 more

CVE-2020-1161

ASP.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Microsoft Redhat

Products

Asp.net Core Visual Studio 2017 Visual Studio 2019 and 2 more

CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed

Vendors

Akka Amazon Apache and 30 more

Products

Http Server Opensearch Data Prepper Apisix and 375 more

CVE-2024-21404

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Microsoft Redhat

Products

.net Asp.net Core Visual Studio and 4 more

CVE-2024-21386

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed

Vendors

Microsoft Redhat

Products

Asp.net Core Visual Studio Visual Studio 2022 and 2 more

CVE-2023-38180

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

CVSS 3.1 · 7.5 High EPSS 14.1% KEV · Listed

Vendors

Fedoraproject Microsoft Redhat

Products

Fedora .net Asp.net Core and 4 more

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

CVSS 3.1 · 6.2 Medium EPSS 1.9% KEV · Not listed

Vendors

Microsoft

Products

.net Asp.net Core Visual Studio 2022

CVE-2026-50506

OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.asp.net .asp.netcore Asp.net Core Odata and 1 more

CVE-2026-45646

OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.asp.net .asp.netcore Asp.net Core Odata and 1 more