← All CVEs

CVE-2026-45591

HIGH 7.5

Published 2026-06-09 · Last modified 2026-07-01

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

2.4%chance of exploitation in 30 days · 82nd percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

ConfidentialityNone
IntegrityNone
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Microsoft Red Hat

Products .Net 10.0 .Net 8.0 .Net 9.0 Asp.Net Core 10.0 Asp.Net Core 8.0 Asp.Net Core 9.0 Microsoft Visual Studio 2026 Version 18.6 Red Hat Enterprise Linux Appstream Eus (V. 10.0)

Weakness (CWE)

CWE-400: Uncontrolled resource consumption
CWE-770: Allocation without limits

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References

Sources: NVD · CVE.org · EPSS