CVE-2026-69304

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Server.IISIntegration versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.Server.IISIntegration versions 10.0.0 through 10.0.11 Microsoft.AspNetCore.Server.IISIntegration versions 9.0.0 through 9.0.19 Microsoft.AspNetCore.Server.IISIntegration versions 8.0.0 through 8.0.30

Description Improper handling of highly compressed data, known as data amplification, in ASP.NET Core IIS out-of-process hosting and request decompression allows an unauthorized attacker to cause a denial of service over a network. The IIS Middleware for ASP.NET Core failed to properly constrain the decompression of certain request types, resulting in excessive memory consumption.

Recommendations Update Microsoft.AspNetCore.Server.IISIntegration to version 11.0.0-rc.1 or later. Update Microsoft.AspNetCore.Server.IISIntegration to version 10.0.12 or later. Update Microsoft.AspNetCore.Server.IISIntegration to version 9.0.20 or later. Update Microsoft.AspNetCore.Server.IISIntegration to version 8.0.31 or later. For self-contained applications targeting any of the impacted versions, recompile and redeploy the applications.