CVE-2025-26682: ASP.NET Core and Visual Studio Denial of Service Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-08 · updated 2026-08-10
Weakness: CWE-770

Description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected products

Microsoft .NET Core: from 8.0.0 before 8.0.15; from 9.0.0 before 9.0.4 — fixed in 8.0.15, 9.0.4
Microsoft Visual Studio 2022 version 17.14: from 17.8.0 before 17.8.20; from 17.10.0 before 17.10.13; from 17.12.0 before 17.12.7; from 17.13.0 before 17.13.6 — fixed in 17.10.13, 17.12.7, 17.13.6, 17.8.20
Microsoft ASP.NET Core 8.0: from 8.0 before 8.0.15 — fixed in 8.0.15
Microsoft ASP.NET Core 9.0: from 9.0 before 9.0.4 — fixed in 9.0.4
Microsoft Visual Studio 2022 version 17.10: from 17.10.0 before 17.10.13 — fixed in 17.10.13
Microsoft Visual Studio 2022 version 17.13: from 17.13.0 before 17.13.6 — fixed in 17.13.6
Microsoft Visual Studio 2022 version 17.8: from 17.8.0 before 17.8.20 — fixed in 17.8.20
Microsoft Visual Studio 2022 version 17.14: from 17.12.0 before 17.12.7 — fixed in 17.12.7

How to fix

Upgrade to a fixed version: Microsoft .NET Core 8.0.15, 9.0.4; Microsoft Visual Studio 2022 version 17.14 17.10.13, 17.12.7, 17.13.6, 17.8.20; Microsoft ASP.NET Core 8.0 8.0.15; Microsoft ASP.NET Core 9.0 9.0.4; Microsoft Visual Studio 2022 version 17.10 17.10.13; Microsoft Visual Studio 2022 version 17.13 17.13.6; Microsoft Visual Studio 2022 version 17.8 17.8.20; Microsoft Visual Studio 2022 version 17.14 17.12.7. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26682

Get alerted when CVE-2025-26682 or the next vulnerability affects your stack