CVE-2026-118748

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 11.0.0-preview.7.26381.103 through 11.0.0-rc.3.26522.148

Description Allocation of resources without limits or throttling allows an unauthorized attacker to cause a denial of service over a network. Specifically, Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, which can lead to remote process memory exhaustion.

Recommendations Update ASP.NET Core to version 11.0.0.