p PatchFirst

CVE-2025-26682

CVE-2025-26682 · ASP.NET Core and Visual Studio Denial of Service Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 7.5 · High · EPSS 1.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • asp.net core 8.0

    Versions
    • ≥ 8.0, < 8.0.15: Affected (custom)

    Update to 8.0.15

  • asp.net core 9.0

    Versions
    • ≥ 9.0, < 9.0.4: Affected (custom)

    Update to 9.0.4

  • microsoft visual studio 2022 version 17.10

    Versions
    • ≥ 17.10.0, < 17.10.13: Affected (custom)

    Update to 17.10.13

  • microsoft visual studio 2022 version 17.12

    Versions
    • ≥ 17.12.0, < 17.12.7: Affected (custom)

    Update to 17.12.7

  • microsoft visual studio 2022 version 17.13

    Versions
    • ≥ 17.13.0, < 17.13.6: Affected (custom)

    Update to 17.13.6

  • microsoft visual studio 2022 version 17.8

    Versions
    • ≥ 17.8.0, < 17.8.20: Affected (custom)

    Update to 17.8.20

  • dotnet6 Ubuntu:22.04:LTS

    Versions
    • 6.0.108-0ubuntu1~22.04.1
    • 6.0.109-0ubuntu1~22.04.1
    • 6.0.110-0ubuntu1~22.04.1
    • 6.0.111-0ubuntu1~22.04.1
    • 6.0.113-0ubuntu1~22.04.1
    • 6.0.116-0ubuntu1~22.04.1
    • 6.0.118-0ubuntu1~22.04.1
    • 6.0.119-0ubuntu1~22.04.1
    • 6.0.120-0ubuntu1~22.04.1
    • 6.0.121-0ubuntu1~22.04.1
    • 6.0.122-0ubuntu1~22.04.1
    • 6.0.123-0ubuntu1~22.04.1
    • 6.0.124-0ubuntu1~22.04.1
    • 6.0.125-0ubuntu1~22.04.1
    • 6.0.126-0ubuntu1~22.04.1
    • 6.0.127-0ubuntu1~22.04.1
    • 6.0.128-0ubuntu1~22.04.2
    • 6.0.132-0ubuntu1~22.04.1
    • 6.0.133-0ubuntu1~22.04.1
    • 6.0.135-0ubuntu1~22.04.1
    • 6.0.136-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dotnet7 Ubuntu:22.04:LTS

    Versions
    • 7.0.105-0ubuntu1~22.04.1
    • 7.0.107-0ubuntu1~22.04.1
    • 7.0.108-0ubuntu1~22.04.1
    • 7.0.109-0ubuntu1~22.04.1
    • 7.0.110-0ubuntu1~22.04.1
    • 7.0.111-0ubuntu1~22.04.1
    • 7.0.112-0ubuntu1~22.04.1
    • 7.0.113-0ubuntu1~22.04.1
    • 7.0.114-0ubuntu1~22.04.1
    • 7.0.115-0ubuntu1~22.04.1
    • 7.0.116-0ubuntu1~22.04.1
    • 7.0.117-0ubuntu1~22.04.1
    • 7.0.117-0ubuntu1~22.04.2
    • 7.0.119-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dotnet8 Ubuntu:22.04:LTS

    Versions
    • 8.0.102-8.0.2-0ubuntu1~22.04.1
    • 8.0.103-8.0.3-0ubuntu1~22.04.1
    • 8.0.103-8.0.3-0ubuntu1~22.04.2
    • 8.0.105-8.0.5-0ubuntu1~22.04.1
    • 8.0.107-8.0.7-0ubuntu1~22.04.1
    • 8.0.108-8.0.8-0ubuntu1~22.04.1
    • 8.0.110-8.0.10-0ubuntu1~22.04.1
    • 8.0.111-8.0.11-0ubuntu1~22.04.1
    • 8.0.112-8.0.12-0ubuntu1~22.04.1
    • 8.0.114-8.0.14-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: < 8.0.115-8.0.15-0ubuntu1~22.04.1

    Update to 8.0.115-8.0.15-0ubuntu1~22.04.1

  • dotnet8 Ubuntu:24.04:LTS

    Versions
    • 8.0.100-8.0.0~rc1-0ubuntu1
    • 8.0.100-8.0.0~rc2-0ubuntu1
    • 8.0.100-8.0.0~rc2-0ubuntu2
    • 8.0.100-8.0.0-0ubuntu1
    • 8.0.100-8.0.0-0ubuntu2
    • 8.0.101-8.0.1-0ubuntu1
    • 8.0.101-8.0.1-0ubuntu2
    • 8.0.102-8.0.2-0ubuntu1
    • 8.0.103-8.0.3-0ubuntu2
    • 8.0.103-8.0.3-0ubuntu3
    • 8.0.104-8.0.4-0ubuntu1
    • 8.0.105-8.0.5-0ubuntu1~24.04.1
    • 8.0.107-8.0.7-0ubuntu1~24.04.1
    • 8.0.108-8.0.8-0ubuntu1~24.04.1
    • 8.0.108-8.0.8-0ubuntu1~24.04.2
    • 8.0.110-8.0.10-0ubuntu1~24.04.1
    • 8.0.111-8.0.11-0ubuntu1~24.04.1
    • 8.0.112-8.0.12-0ubuntu1~24.04.1
    • 8.0.114-8.0.14-0ubuntu1~24.04.1
    Affected ranges
    • ECOSYSTEM: < 8.0.115-8.0.15-0ubuntu1~24.04.1

    Update to 8.0.115-8.0.15-0ubuntu1~24.04.1

  • dotnet8 Ubuntu:25.10

    Affected ranges
    • ECOSYSTEM: < 8.0.115-8.0.15-0ubuntu1

    Update to 8.0.115-8.0.15-0ubuntu1

  • dotnet9 Ubuntu:25.10

    Affected ranges
    • ECOSYSTEM: < 9.0.105-9.0.4-0ubuntu1

    Update to 9.0.105-9.0.4-0ubuntu1

Original sources

Check your server →