CVE-2026-70159

Awaiting Analysis Awaiting Analysis - Queue

Allocation of Resources Without Limits in ASP.NET Core

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70159

EUVD

EUVD-2026-99691

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Microsoft	Visual Studio 2022 version 17.14 17.14.0
Microsoft	Microsoft	Visual Studio 2026 version 18.10 18.10.0
Microsoft	Microsoft.AspNetCore.SignalR.Common	10.0.0
Microsoft	Microsoft.AspNetCore.SignalR.Core	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in ASP.NET Core involves a lack of resource limits or throttling, allowing an unauthorized attacker to consume excessive resources over a network and cause a denial of service.

Impact Analysis

An attacker could exploit this to overload your ASP.NET Core applications, making them unresponsive or unavailable to legitimate users, disrupting services.

Compliance Impact

This vulnerability allows denial of service attacks, which could disrupt availability of systems handling sensitive data. For GDPR, this may impact the right to access data if services are unavailable. For HIPAA, it could affect the availability of protected health information systems.

Mitigation Strategies

Apply the latest security updates from Microsoft for ASP.NET Core components. Monitor network traffic for unusual patterns indicating resource exhaustion attempts.

Hi! I’m here to help you understand CVE-2026-70159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70