CVE-2026-114149

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 8.0.0-preview.1.23112.2 through 8.0.33 ASP.NET Core versions 9.0.0-preview.1.24081.5 through 9.0.22 ASP.NET Core versions 10.0.0-preview.1.25120.3 through 10.0.14 ASP.NET Core versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148 Microsoft.AspNetCore.WebUtilities versions 8.0.0-preview.5.23302.2 through 8.0.33 Microsoft.AspNetCore.WebUtilities versions 9.0.0-preview.1.24081.5 through 9.0.22 Microsoft.AspNetCore.WebUtilities versions 10.0.0-preview.1.25120.3 through 10.0.14 Microsoft.AspNetCore.WebUtilities versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148

Description Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to cause a denial of service over a network. The issue occurs because multipart form processing can bypass the configured header-count limit, leading to the consumption of excessive resources.

Recommendations Update ASP.NET Core versions 8.0.0-preview.1.23112.2 through 8.0.33 to version 8.0.34. Update ASP.NET Core versions 9.0.0-preview.1.24081.5 through 9.0.22 to version 9.0.23. Update ASP.NET Core versions 10.0.0-preview.1.25120.3 through 10.0.14 to version 10.0.15. Update ASP.NET Core versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148 to version 11.0.0. Update Microsoft.AspNetCore.WebUtilities versions 8.0.0-preview.5.23302.2 through 8.0.33 to version 8.0.34. Update Microsoft.AspNetCore.WebUtilities versions 9.0.0-preview.1.24081.5 through 9.0.22 to version 9.0.23. Update Microsoft.AspNetCore.WebUtilities versions 10.0.0-preview.1.25120.3 through 10.0.14 to version 10.0.15. Update Microsoft.AspNetCore.WebUtilities versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148 to version 11.0.0.