CVE-2025-26682: Microsoft ASP.NET Core

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products

• Microsoft ASP.NET Core: from 8.0.0, before 8.0.15 (fixed in 8.0.15); from 9.0.0, before 9.0.4 (fixed in 9.0.4)
• Microsoft Visual Studio 2022: from 17.8.0, before 17.8.20 (fixed in 17.8.20); from 17.10.0, before 17.10.13 (fixed in 17.10.13); from 17.12.0, before 17.12.7 (fixed in 17.12.7); from 17.13.0, before 17.13.6 (fixed in 17.13.6)

Published 2025-04-08. Last modified 2026-06-17.