CVE-2026-70196

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-70196) has been identified in ASP.NET Core's form body parser. When form data arrives in many small pieces, ASP.NET Core re-examines everything it has buffered so far on every read, so an unauthenticated client can make the server spend CPU time that grows with the square of the value length.

Per CWE-407: Inefficient Algorithmic Complexity, the weakness is an algorithm whose worst-case computational complexity is significantly worse than desired, and an attacker can trigger that worst case.

This issue affects ASP.NET Core 6.0 applications on any endpoint that reads URL-encoded form data, on Windows, Linux, and macOS. Microsoft's advisory lists ASP.NET Core 8.0, 9.0 and 10.0 as affected; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application at version 6.0.46 or earlier that reads URL-encoded form bodies.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.WebUtilities
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This Medium-severity vulnerability is found in the FormPipeReader type in Microsoft.AspNetCore.WebUtilities, part of the ASP.NET Core shared framework.

FormPipeReader parses application/x-www-form-urlencoded bodies by searching the buffered data for the & separator between key-value pairs. When a pair has not fully arrived yet, the reader waits for more data and tries again. Before the fix, each retry in ParseFormValues started the search from the beginning of the unconsumed buffer. A client that sends one long value a few bytes at a time made the server rescan the same growing buffer on every read, so the total work grew quadratically with the value's length. HeroDevs measured a 4 MB value, the default limit, sent 100 bytes at a time taking about 1.9 seconds of parsing on unpatched .NET 6, against about 46 ms with the fix.

The fix remembers how far the previous search reached and resumes from there, rescanning only enough bytes to find a multi-byte separator split across reads.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Dr.-Ing Ashar Javed (@soaj1664ashar), as credited in Microsoft's advisory.