CVE-2026-109478

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-109478) has been identified in ASP.NET Core's handling of comma-separated HTTP header values. Splitting a header into its values allocated memory that grew with the square of the number of values, so a single crafted header from an unauthenticated client can force very large memory allocations.

Per CWE-407: Inefficient Algorithmic Complexity, the weakness is an algorithm whose worst-case computational complexity is significantly worse than desired, and an attacker can trigger that worst case.

This issue affects ASP.NET Core 6.0 applications on Windows, Linux, and macOS that use CORS, the forwarded headers middleware, WebSockets, or MVC [FromHeader] binding, or that read header values through GetCommaSeparatedValues. Microsoft's advisory lists only ASP.NET Core 8.0 and early 9.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application at version 6.0.48 or earlier that splits comma-separated request header values.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.Http.Abstractions
• Affected versions:
  • >= 6.0.0 <= 6.0.48
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.49

Vulnerability Info

This High-severity vulnerability is found in the GetCommaSeparatedValues extension method in Microsoft.AspNetCore.Http.Abstractions, part of the ASP.NET Core shared framework.

GetCommaSeparatedValues splits a header such as Access-Control-Request-Headers or X-Forwarded-For into its individual values. Before the fix, the internal helper behind it appended each value with StringValues.Concat, which copies the whole array collected so far every time. A header with n values therefore allocated on the order of n² array slots. Kestrel's default 32 KB limit on request headers leaves room for about 16,000 short values in one header, and HeroDevs measured roughly 1 GB of allocations for such a header on unpatched .NET 6. Repeated requests can exhaust memory or stall the server in garbage collection.

The fix collects the values in a pooled list builder and allocates the result array once, so allocation grows linearly with the number of values. Microsoft made the same change in the 9.0 previews in 2024 as a performance improvement, which is why 9.0 and later releases are not affected.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  • NES for .NET 6.0.49 or later
  • .NET / ASP.NET Core 10.0 or later
  • .NET / ASP.NET Core 11.0 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later.

Credits

Matteo Panzeri, as credited in Microsoft's advisory.