CVE-2026-26130: microsoft asp.net_core

CVSS: 7.5v3.1HighModified

AliasesRHSA-2026:10082RHSA-2026:10084RHSA-2026:10091+13 more

Published 10-03-2026Last modified 15-07-2026

Vulnerability summary

CVE-2026-26130 is a high (CVSS 7.5) vulnerability in microsoft asp.net_core. EPSS estimates a 2.54% chance of exploitation in the next 30 days, higher than 84.7% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

2.54%

0%100%

Low · -0.28 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 1 · Downstream 8 · Related 3

GHSA-VH8F-65QG-3M8J RHSA-2026:10083 RHSA-2026:10085 RHSA-2026:4443 RHSA-2026:4445 RHSA-2026:4450+6 more

Timeline

10-03-2026
PublishedVulnerability first disclosed.
15-07-2026
Last modifiedVulnerability information updated.

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

2.54%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

-0.28 pp

From 2.82% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Redhat22 products

aspnetcore-runtime-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
aspnetcore-runtime-dbg-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
aspnetcore-targeting-pack-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-apphost-pack-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-apphost-pack-8.0-debuginfo< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10

dotnet-host< 0:8.0.25-1.el9_4
dotnet-host-debuginfo< 0:8.0.25-1.el9_4
dotnet-hostfxr-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-hostfxr-8.0-debuginfo< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-runtime-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-runtime-8.0-debuginfo< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-runtime-dbg-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-sdk-8.0< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el10_0 | < 0:8.0.125-1.el10_1 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
dotnet-sdk-8.0-debuginfo< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el10_0 | < 0:8.0.125-1.el10_1 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
dotnet-sdk-8.0-source-built-artifacts< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el10_0 | < 0:8.0.125-1.el10_1 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
dotnet-sdk-dbg-8.0< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el10_0 | < 0:8.0.125-1.el10_1 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
dotnet-targeting-pack-8.0< 0:8.0.25-1.el9_4 | < 0:8.0.25-1.el9_6 | < 0:8.0.25-1.el10_0 | < 0:8.0.25-1.el10_1 | < 0:8.0.25-1.el9_7 | < 0:8.0.25-1.el8_10
dotnet-templates-8.0< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el10_0 | < 0:8.0.125-1.el10_1 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
dotnet8.0< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el10_0 | < 0:8.0.125-1.el10_1 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
dotnet8.0-debuginfo< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
dotnet8.0-debugsource< 0:8.0.125-1.el9_4 | < 0:8.0.125-1.el9_6 | < 0:8.0.125-1.el10_0 | < 0:8.0.125-1.el10_1 | < 0:8.0.125-1.el9_7 | < 0:8.0.125-1.el8_10
netstandard-targeting-pack-2.1< 0:8.0.125-1.el9_4

Show all 22

NuGet12 products

Microsoft.AspNetCore.App.Runtime.linux-arm≥ 8.0.0, < 8.0.25 | ≥ 9.0.0, < 9.0.14 | ≥ 10.0.0, < 10.0.4
Microsoft.AspNetCore.App.Runtime.linux-arm64≥ 8.0.0, < 8.0.25 | ≥ 9.0.0, < 9.0.14 | ≥ 10.0.0, < 10.0.4
Microsoft.AspNetCore.App.Runtime.linux-musl-arm≥ 8.0.0, < 8.0.25 | ≥ 9.0.0, < 9.0.14 | ≥ 10.0.0, < 10.0.4
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64≥ 8.0.0, < 8.0.25 | ≥ 9.0.0, < 9.0.14 | ≥ 10.0.0, < 10.0.4
Microsoft.AspNetCore.App.Runtime.linux-musl-x64≥ 8.0.0, < 8.0.25 | ≥ 9.0.0, < 9.0.14 | ≥ 10.0.0, < 10.0.4

Show all 12

Ubuntu5 products

dotnet10< 10.0.104-10.0.4-0ubuntu1~24.04.1 | < 10.0.104-10.0.4-0ubuntu1~25.10.1 | < 10.0.104-10.0.4-0ubuntu1
dotnet6All versions (No fix recorded)
dotnet7All versions (No fix recorded)
dotnet8< 8.0.125-8.0.25-0ubuntu1~22.04.1 | < 8.0.125-8.0.25-0ubuntu1~24.04.1 | < 8.0.125-8.0.25-0ubuntu1~25.10.1
dotnet9< 9.0.115-9.0.14-0ubuntu1~25.10.1

Microsoft4 products

asp.net_core≥ 8.0.0, < 8.0.25 | ≥ 9.0.0, < 9.0.14 | ≥ 10.0.0, < 10.0.4
asp.net core 10.0≥ 10.0, < 10.0.4
asp.net core 8.0≥ 8.0, < 8.0.25
asp.net core 9.0≥ 9.0, < 9.0.14

Chainguard3 products

dotnet-bootstrap-10All versions (No fix recorded)
dotnet-bootstrap-8< 8.0.126-r0
dotnet-bootstrap-9< 9.0.115-r0

Wolfi3 products

dotnet-bootstrap-10All versions (No fix recorded)
dotnet-bootstrap-8< 8.0.126-r0
dotnet-bootstrap-9< 9.0.115-r0

6 vendors · 49 products

References

33 links

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130Vendor AdvisoryPatchARTICLEREPORTAdvisoryWEB
access.redhat.com/security/cve/CVE-2026-26130VDB EntryX Refsource REDHATREPORTWEB
bugzilla.redhat.com/show_bug.cgi?id=2446134Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26130.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:10091Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10083Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4453Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4451Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4450Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4458Vendor AdvisoryX Refsource REDHATAdvisory

Show all 33 references

access.redhat.com/errata/RHSA-2026:4455Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4443Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10082Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10084Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10085Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4445Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4454Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4456Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10082.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2026-26130AdvisoryREPORTWEB
nvd.nist.gov/vuln/detail/CVE-2026-26130Advisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10084.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10091.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4451.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4454.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4455.jsonAdvisory
ubuntu.com/security/CVE-2026-26130REPORT
devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-march-2026-servicing-updatesREPORT
github.com/dotnet/announcements/issues/385REPORT
ubuntu.com/security/notices/USN-8085-1Advisory
github.com/dotnet/aspnetcore/security/advisories/GHSA-4vgm-c2wm-63mwWEB
github.com/dotnet/aspnetcorePACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities