Uncontrolled Resource Consumption in ASP.NET Core

Publication date: 2026-06-09

Last updated on: 2026-06-19

Assigner: Microsoft Corporation

Description

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-19

Generated

2026-06-30

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-45591

EUVD

EUVD-2026-35549

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	asp.net_core	From 10.0.0 (inc) to 10.0.9 (exc)
microsoft	asp.net_core	From 8.0.0 (inc) to 8.0.28 (exc)
microsoft	asp.net_core	From 9.0.0 (inc) to 9.0.17 (exc)
microsoft	visual_studio_2026	From 18.6.0 (inc) to 18.6.3 (exc)
microsoft	.net	From 10.0.0 (inc) to 10.0.9 (exc)
microsoft	.net	From 8.0.0 (inc) to 8.0.28 (exc)
microsoft	.net	From 9.0.0 (inc) to 9.0.17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled resource consumption in ASP.NET Core, which allows an unauthorized attacker to cause a denial of service over a network.

Impact Analysis

The impact of this vulnerability is a denial of service, meaning that an attacker can exhaust system resources and make the ASP.NET Core service unavailable to legitimate users.

Hi! I’m here to help you understand CVE-2026-45591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70