How does CVE-2026-70181 threaten ASP.NET Core memory limits?

Microsoft has addressed a high-severity denial of service vulnerability in ASP.NET Core, tracked as CVE-2026-70181. The flaw resides in the Microsoft.AspNetCore.WebUtilities component and stems from improper resource management. According to the Microsoft Security Update Guide, the issue allows unauthorized network attackers to deny service by triggering uncontrolled resource allocation. This affects applications running on Windows, Linux and macOS systems.

Root cause

The underlying technical issue involves the FileBufferingReadStream class during multipart processing. According to the GitHub advisory, this component eagerly rents memory buffers without sufficient limits or throttling. This behavior enables memory exhaustion when handling specific requests. The weakness is classified as CWE-770, which covers the allocation of resources without limits. This design flaw allows an attacker to consume available memory until the service becomes unresponsive.

Attack path

An attacker can exploit this vulnerability over a network without requiring authentication. The CVSS vector indicates that no user interaction is necessary for the attack to succeed. By sending crafted requests that trigger the multipart processing logic, an adversary can force the application to allocate excessive memory. This leads to a denial of service condition where legitimate users cannot access the application. The impact is strictly on availability, with no compromise of confidentiality or integrity.

Affected versions

• ASP.NET Core 8.0.0 through 8.0.31 is vulnerable; patch 8.0.32 fixes it.
• ASP.NET Core 9.0.0 through 9.0.20 is vulnerable; patch 9.0.21 fixes it.
• ASP.NET Core 10.0.0 through 10.0.12 is vulnerable; patch 10.0.13 fixes it.

These versions span all supported architectures including x64, arm and arm64 on Linux, Windows and macOS.

Mitigation

• Upgrade ASP.NET Core 8.x applications to version 8.0.32 or later.
• Update ASP.NET Core 9.x applications to version 9.0.21 or later.
• Install version 10.0.13 or later for ASP.NET Core 10.x deployments.
• Verify that all runtime packages match the patched versions listed in the advisory.

What it means for organisations

Operations teams must immediately inventory all services using ASP.NET Core to identify exposure. Security leaders should coordinate with development groups to prioritize patching based on internet-facing assets. Procurement teams need to verify that third-party suppliers have updated their hosted applications. Internal communications should alert stakeholders about potential service interruptions during the update process. This ensures a coordinated response to minimize operational risk and maintain service continuity for critical business functions.

What to do and how to stay safe: ASP.NET Core

• Audit your infrastructure to locate all instances of ASP.NET Core versions 8, 9 and 10.
• Test the patched versions in a staging environment before deploying to production systems.
• Monitor server memory usage for signs of abnormal allocation or exhaustion patterns.
• Review multipart upload configurations to ensure appropriate size limits are enforced.

Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-70181?

The vulnerability has a CVSS 3.1 score of 7.5, which is rated as high severity.

Which component contains the vulnerability?

The flaw is located in the Microsoft.AspNetCore.WebUtilities component, specifically within the FileBufferingReadStream class.

Are there any known workarounds besides patching?

The source material does not mention any temporary workarounds; applying the vendor-provided patches is the recommended mitigation.