CVE-2026-70196 · GHSA-57xr-hfxx-jw5x

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Risk score: 57/100
CVSS: 5.9 v3.1
Exploit chance (30 days): 0.9%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Affected: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) >= 8.0.0, <= 8.0.31
Fix: Upgrade Microsoft.AspNetCore.App.Runtime.linux-arm to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 to 8.0.32; Mi…
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.AspNetCore.App.Runtime.linux-arm: Red, act today. Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

The flaws

CVE-2026-70196: Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability (CVSS 5.9 · EPSS 1%)
CVE-2026-70188: Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability (CVSS 9.1 · EPSS 1%)
CVE-2026-70175: Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.1 · EPSS 1%)
CVE-2026-70181: Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)

The fix

Fix: Upgrade Microsoft.AspNetCore.App.Runtime.linux-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-mu…

Who is exposed: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Run…

Where it stands

No known exploitation

Connects to

Same weakness: Denial of service (CWE-407). 71 other warnings in 30 days

Why it is Yellow

CVSS 5.9 medium
On your watchlist: asp.net core, NuGet

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
Microsoft.AspNetCore.App.Runtime.linux-arm	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.osx-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.osx-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.win-arm	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.win-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.win-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.win-x86	nuget	>= 8.0.0, <= 8.0.31	8.0.32

References

Original description

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.