Known vulnerabilities in ASP.NET Core

Vendor: Microsoft
Software: ASP.NET Core
Software CPE: cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
Total vulnerabilities: 12
Public exploits: 2
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ASP.NET Core ASP.NET Core is affected by 12 known vulnerabilities: 5 high, 4 medium, 3 low Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134477 - Resource exhaustion
CVE-2026-45591
CWE-400 Medium
No
No
8.0.28, 9.0.17 12.06.2026 SB2026061277
SB2026061283
SB2026061284
and 10 more
#VU126862 - Improper Verification of Cryptographic Signature
CVE-2026-40372
CWE-347 High
No
No
10.0.7 22.04.2026 SB20260422218
SB2026042923
SB2026042924
and 3 more
#VU123769 - Allocation of Resources Without Limits or Throttling
CVE-2026-26130
CWE-770 Medium
No
No
8.0.25, 9.0.14, 10.0.4 10.03.2026 SB20260310118
SB2026031224
SB2026031227
and 19 more
#VU117236 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2025-55315
CWE-444 Medium
Available
No
8.0.21 8.0.21, 9.0.10 9.0.10 15.10.2025 SB2025101593
SB20251015138
SB20251015139
and 9 more
#VU107240 - Allocation of Resources Without Limits or Throttling
CVE-2025-26682
CWE-770 High
No
No
8.0.16 8.0.16, 9.0.5 9.0.5 08.04.2025 SB2025040897
#VU105568 - Improper Authentication
CVE-2025-24070
CWE-287 High
No
No
8.0.14 8.0.14, 9.0.3 9.0.3 11.03.2025 SB20250311101
SB2025031215
SB2025031778
and 4 more
#VU83143 - Improper input validation
CVE-2023-36038
CWE-20 Medium
No
Exploited
- 15.11.2023 SB2023111504
#VU83142 - Security Features
CVE-2023-36558
CWE-254 Low
No
No
- 15.11.2023 SB2023111504
SB2023111551
SB2023112362
and 9 more
#VU81728 - Resource exhaustion
CVE-2023-44487
CWE-400 High
Available
Exploited
6.0.23, 7.0.12 10.10.2023 SB2023101023
SB2023101024
SB2023101037
and 650 more
#VU79255 - Exposure of sensitive information to an unauthorized actor
CVE-2023-35391
CWE-200 Low
No
No
2.1.40 08.08.2023 SB20230808137
SB2023092110
#VU79145 - Improper input validation
CVE-2023-38180
CWE-20 High
No
Exploited
2.1.40 08.08.2023 SB2023080865
SB2023080903
SB2023081036
and 12 more
#VU58923 - Permissions, Privileges, and Access Controls
CVE-2021-43877
CWE-264 Low
No
No
- 14.12.2021 SB2021121451