SB2026111129 - Multiple vulnerabilities in .NET

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111129

SB2026111129 - Multiple vulnerabilities in .NET

Published: November 11, 2026

Security Bulletin ID SB2026111129
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2026-109481)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to insufficient validation of request authenticity in ASP.NET Core when handling state-changing requests. A remote attacker can trick a victim into submitting a forged request in the context of their session to escalate privileges, potentially compromising data confidentiality, data integrity, and service availability.


2) Use of uninitialized resource (CVE-ID: CVE-2026-114150)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in ASP.NET Core when handling network requests. A remote attacker can trigger use of the uninitialized resource to disclose information that should not be accessible.


3) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-114156)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass security features and potentially access or modify protected information.

The vulnerability exists due to improper resolution of path equivalence in ASP.NET Core when handling network requests. A remote attacker can submit specially crafted requests using equivalent path representations to bypass security checks and potentially access or modify protected information.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-118748)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network requests. A remote attacker can send requests that exhaust available resources to cause a denial of service.


5) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-118749)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in ASP.NET Core when processing network requests. A remote attacker can send specially crafted requests that trigger excessive computational resource consumption to cause a denial of service.


Remediation

Install update from vendor's website.

References