Allocation of Resources Without Limits in ASP.NET Core

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-57099

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	asp.net_core	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in ASP.NET Core involves a lack of resource allocation limits or throttling. An unauthorized attacker can exploit this to consume excessive server resources, leading to a denial of service over the network.

Impact Analysis

The impact includes service disruption as the server becomes overwhelmed, leading to downtime for applications relying on ASP.NET Core. This can affect user access and application availability.

Mitigation Strategies

Apply the latest security updates from Microsoft for ASP.NET Core to address the resource allocation issue. Monitor network traffic for unusual patterns indicating denial-of-service attempts. Consider implementing rate limiting or throttling mechanisms in your ASP.NET Core applications.

Hi! I’m here to help you understand CVE-2026-57099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70