CVE-2026-45591 Details
Description
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
A denial-of-service vulnerability has been identified in ASP.NET Core, specifically in versions 8.0, 9.0, and 10.0, as well as in .NET 8.0 and 10.0 across Windows, Linux, and Mac OS. This vulnerability allows an unauthorized attacker to cause uncontrolled resource consumption, leading to a denial-of-service condition over the network.
Users can download the security update for ASP.NET Core and .NET 10.0 from the official .NET website. For ASP.NET Core 9.0 and 8.0, the security update is also available on the .NET website. Visual Studio 2026 users can download the security update through the Visual Studio Downloads page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | redhat-SADP |
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft asp.net core | >= 8.0.0, < 8.0.28 >= 9.0.0, < 9.0.17 >= 10.0.0, < 10.0.9 |
CPE
Remediation
| |
| microsoft visual studio 2026 | >= 18.6.0, < 18.6.3 |
CPE
Remediation
| |
| microsoft .net | >= 8.0.0, < 8.0.28 >= 9.0.0, < 9.0.17 >= 10.0.0, < 10.0.9 |
CPE
Remediation
| |
| apple macos | All versions |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 19, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | [email protected] |