CVE-2026-114149

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-114149) has been identified in ASP.NET Core's multipart form parsing. The limit on how many headers each part of a multipart request may carry counted distinct header names rather than header lines, so an unauthenticated client can bypass it by repeating one header name and make the server consume excessive resources.

Per CWE-770: Allocation of Resources Without Limits or Throttling, the weakness is a product allocating a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated.

This issue affects ASP.NET Core 6.0 applications that read multipart request bodies, such as file uploads and multipart form posts, on Windows, Linux, and macOS. Microsoft's advisory lists ASP.NET Core 8.0, 9.0, 10.0 and 11.0 as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application at version 6.0.48 or earlier that reads multipart request bodies.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.WebUtilities
• Affected versions:
  • >= 6.0.0 <= 6.0.48
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.49

Vulnerability Info

This High-severity vulnerability is found in the MultipartReader type in Microsoft.AspNetCore.WebUtilities, part of the ASP.NET Core shared framework.

MultipartReader reads the header block of each multipart section and enforces HeadersCountLimit, which form reading sets from FormOptions.MultipartHeadersCountLimit, 16 by default. Before the fix, the check compared the limit against the number of distinct header names collected for the section. A section that repeated one header name, such as X-Dup: v many times over, never reached the limit, so the count limit gave no protection and only the separate header length limit bounded the section.

The fix counts every header line, so repeated names count separately and a section with more header lines than the configured limit is rejected. This is a behavior change: an application whose clients legitimately send more header lines per section than the limit, even under repeated names, needs to raise MultipartHeadersCountLimit.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  • NES for .NET 6.0.49 or later
  • .NET / ASP.NET Core 10.0.15 or later
  • .NET / ASP.NET Core 11.0.0 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later.

Credits

n0irx, as credited in Microsoft's advisory.