Microsoft Asp.Net Core vulnerabilities
41 vulnerabilities
Known vulnerabilities in Microsoft Asp.Net Core, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-88092chainguarddotnet-bootstrap-8+23
EPSS score0.79%
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.CVE-2018-0784microsoft corporationasp.net core+1EPSS score6.50%
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0808.CVE-2018-0785microsoft corporationasp.net core+1EPSS score3.03%
ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability".CVE-2018-0875microsoft corporation.net core+12EPSS score9.08%
.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability".CVE-2018-0787microsoft corporationasp.net core+3EPSS score9.57%
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".CVE-2018-0808microsoft corporationasp.net core+1EPSS score7.76%
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0784.CVE-2018-8409microsoftasp.net_core+5EPSS score6.56%
A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.CVE-2018-8416ubuntumono+10EPSS score7.26%
A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.CVE-2018-8292microsoftasp.net_core+7EPSS score14.83%
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.CVE-2018-8171microsoftasp.net+5EPSS score10.77%
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.CVE-2018-8356microsoftasp.net_core+11EPSS score0.75%
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.CVE-2021-1723fedoraprojectfedora+77EPSS score5.30%
ASP.NET Core and Visual Studio Denial of Service VulnerabilityCVE-2021-43877microsoftasp.net_core+10EPSS score0.73%
ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityCVE-2021-34532microsoftasp.net_core+10EPSS score1.22%
ASP.NET Core and Visual Studio Information Disclosure VulnerabilityCVE-2025-55315chainguardazure-functions-extension-bundles-4+34EPSS score65.94%
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.CVE-2025-26682ubuntudotnet6+11EPSS score1.71%
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2025-24070ubuntudotnet6+67EPSS score1.01%
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2020-1045fedoraprojectfedora+51EPSS score5.93%
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p>
<p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p>
<p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>CVE-2020-1161microsoftasp.net_core+16EPSS score5.31%
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application.
The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.CVE-2020-1597fedoraprojectfedora+52EPSS score6.56%
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application.
The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.