CVE-2026-118750

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.WebUtilities versions 2.3.0 through 2.3.13

Description Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to cause a denial of service over a network. Specifically, the FileBufferingReadStream buffer allocation can be exploited via unauthenticated multipart-form requests to exhaust system memory.

Recommendations Update Microsoft.AspNetCore.WebUtilities to version 2.3.14, then rebuild and redeploy the application.