CVE-2026-109468HighCVSS 7.5
ASP.NET Core Denial of Service Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎯 Affected products11
- Microsoft Visual Studio 2022 version 17.14
- Microsoft Visual Studio 2026 version 18.10
- System.Formats.Cbor on .NET 10.0 runtime installed on Linux
- System.Formats.Cbor on .NET 10.0 runtime installed on Mac OS
- System.Formats.Cbor on .NET 10.0 runtime installed on Windows
- System.Formats.Cbor on .NET 8.0 runtime installed on Linux
- System.Formats.Cbor on .NET 8.0 runtime installed on Mac OS
- System.Formats.Cbor on .NET 8.0 runtime installed on Windows
- System.Formats.Cbor on .NET 9.0 runtime installed on Linux
- System.Formats.Cbor on .NET 9.0 runtime installed on Mac OS
- System.Formats.Cbor on .NET 9.0 runtime installed on Windows
✅ Remediation
KBRelease Notes (Security Update) — fixed build 10.0.13 KBRelease Notes (Security Update) — fixed build 8.0.1 KBRelease Notes (Security Update) — fixed build 9.0.21 KBRelease Notes (Security Update) — fixed build 18.10.4 KBRelease Notes (Security Update) — fixed build 17.14.42
🔗 References (6)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109468
- patchhttps://www.nuget.org/packages/System.Formats.Cbor
- patchhttps://learn.microsoft.com/en-us/visualstudio/releases/2026/release-history
- referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
- patchhttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-history
- referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes