CVE-2026-57099

CVE-2026-57099 is a denial-of-service flaw in ASP.NET Core (CWE-770): the framework allocates resources without limits or throttling, so an unauthenticated remote attacker can send crafted network traffic that drives unbounded resource consumption and exhausts the host. It is triggered over the network by requests to an affected ASP.NET Core application, with no privileges or user interaction required. Successful exploitation impacts availability only — the CVSS vector shows no confidentiality or integrity impact — so the attacker can crash, hang, or degrade the service but cannot read or modify data. Any organization running ASP.NET Core applications is potentially affected, with highest risk for internet-facing apps, APIs, and services where anonymous attackers can reach the endpoint directly. No public proof-of-concept or known exploitation exists; the flaw carries a modest EPSS of 0.8% (55th percentile) and was addressed in Microsoft's September 2026 Patch Tuesday release.

What to do: Apply the ASP.NET Core/.NET updates released in Microsoft's September 2026 Patch Tuesday, prioritizing internet-facing applications and APIs. As interim mitigations, enable rate limiting, reverse-proxy request size/body limits and timeouts, and connection or concurrency caps to bound resource consumption per client. Inventory which servers and containerized workloads run ASP.NET Core and identify which endpoints are reachable by unauthenticated network users before patching.