CVE-2026-114150

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 11.0.0-preview.2.26159.112 through 11.0.0-rc.3.26522.148

Description Use of an uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network. Specifically, a reused ResponseBufferingStream can retain pooled tail memory, which may expose response-body data from a different request through HTTP logging.

Recommendations Update ASP.NET Core to version 11.0.0.