CVE-2026-57099 - Vulnerability Details - OpenCVE

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Microsoft	.asp.netcore .asp.netcore

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57099
https://nvd.nist.gov/vuln/detail/CVE-2026-57099
https://www.cve.org/CVERecord?id=CVE-2026-57099

History

Wed, 09 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-57099 https://www.cve.org/CVERecord?id=CVE-2026-57099
Metrics	threat_severity `None`	threat_severity `Important`

Tue, 08 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 08 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft .asp.netcore
Vendors & Products		Microsoft .asp.netcore

Tue, 08 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Title		ASP.NET Core Denial of Service Vulnerability
First Time appeared		Microsoft Microsoft .asp.netcore
Weaknesses		CWE-770
CPEs		cpe:2.3:a:microsoft:.Asp.NetCore::::::::
Vendors & Products		Microsoft Microsoft .asp.netcore
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57099
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-09-08T17:19:11.329Z

Updated: 2026-09-09T21:36:09.995Z

Reserved: 2026-06-23T18:29:51.054Z

Link: CVE-2026-57099

Vulnrichment

Updated: 2026-09-08T20:45:22.200Z

NVD

Status : Awaiting Analysis

Published: 2026-09-08T18:17:43.057

Modified: 2026-09-08T21:18:14.133

Link: CVE-2026-57099

Redhat

Severity : Important

Publid Date: 2026-09-08T17:19:11Z

Links: CVE-2026-57099 - Bugzilla

{"bugzilla": {"description": "ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation", "id": "2529970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529970"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service (DoS) by allocating resources without limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users."], "name": "CVE-2026-57099", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "dotnet/sdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet11.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet6.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet7.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dotnet/sdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "dotnet10.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "dotnet8.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "dotnet9.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/udi-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-09-08T17:19:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57099\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57099\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57099"], "threat_severity": "Important"}