CVE-2026-70181

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-70181) has been identified in ASP.NET Core's request body buffering. When reading form and multipart content, ASP.NET Core reserves a full memory buffer for each section before any data arrives, so an unauthenticated client can make the server hold far more memory than it sends and exhaust it.

Per CWE-770: Allocation of Resources Without Limits or Throttling, the weakness is a product allocating a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated.

This issue affects ASP.NET Core 6.0 applications that read form or multipart request bodies, such as form posts and file uploads, on Windows, Linux, and macOS. Microsoft's advisory lists ASP.NET Core 8.0, 9.0 and 10.0 as affected; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application at version 6.0.46 or earlier that reads form or multipart request bodies.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.WebUtilities
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the FileBufferingReadStream type in Microsoft.AspNetCore.WebUtilities, part of the ASP.NET Core shared framework.

FileBufferingReadStream lets ASP.NET Core read a request body more than once. It keeps the body in memory up to a threshold, 64 KB per form section by default, and moves it to a temporary file beyond that. Form and multipart processing create one of these streams per section. Before the fix, each stream rented its entire memory threshold from the shared array pool in its constructor, before reading a single byte. A request made of many tiny sections, spread across concurrent HTTP/2 streams, therefore tied up memory out of all proportion to the bytes the client sent.

The fix replaces the up-front buffer with a pooled memory stream that rents memory only as data is written, grows up to the same threshold, and returns its buffer when disposed or when the stream switches to a temporary file. An empty section now rents nothing.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

kayiz with Lien Phat Technology Corporation, jhanks, and Anonymous, as credited in Microsoft's advisory.