CVE-2026-69304

CVE-2026-69304 is a denial-of-service flaw in ASP.NET Core caused by improper handling of highly compressed data, where small malicious inputs expand enormously when processed (data amplification, CWE-409). A remote, unauthenticated attacker can trigger it by sending specially crafted highly compressed data to a vulnerable server over the network, although the high attack-complexity rating means exploitation depends on specific processing conditions rather than succeeding on every request. Successful exploitation affects availability only: the CVSS 5.9 score reflects high availability impact with no confidentiality or integrity loss, so the attacker gains the ability to disrupt or exhaust a service, not to steal or modify data. Any application or server built on ASP.NET Core (distributed via NuGet and bundled with the .NET runtime) is potentially affected, and fixes shipped as part of Microsoft's September 2026 Patch Tuesday. There is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.8% 30-day exploitation probability, so no active exploitation is currently known.

What to do: Apply Microsoft's September 2026 .NET/ASP.NET Core security updates (via the .NET runtime/SDK installers and updated NuGet packages) and rebuild or redeploy affected web applications. Prioritize services that decompress client-supplied request bodies or accept compressed uploads, and as an interim mitigation enforce limits on decompressed request sizes where supported. With no public PoC or known in-the-wild exploitation, this can be handled within your normal Patch Tuesday patching cycle.