CVE-2026-118749

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 11.0.0-rc.1.26425.128 through 11.0.0-rc.3.26522.148 Microsoft.Extensions.Validation versions 11.0.0-rc.1.26425.128 through 11.0.0-rc.3.26522.148

Description Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to cause a denial of service over a network. Specifically, Minimal API validation repeatedly copies a growing validation-error dictionary, which enables attacker-controlled collections to trigger quadratic CPU work after the client disconnects.

Recommendations Update ASP.NET Core to version 11.0.0. Update Microsoft.Extensions.Validation to version 11.0.0.