Allocation of Resources Without Limits or Throttling in Microsoft products - CVE-2026-56170

Vulnerability identifier: #VU137778

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-56170

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to unrestricted resource allocation in ASP.NET Core. A remote attacker can bypass implemented security restrictions and perform a denial of service (DoS) attack.

.NET for Linux
.NET for macOS
.NET
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
dotnet8.0 (Red Hat package)
dotnet9.0 (Red Hat package)

Install updates from vendor's website.

.NET for Linux - addressed in versions 8.0.29, 9.0.18
.NET - addressed in versions 8.0.29, 9.0.18
.NET for macOS - addressed in versions 8.0.29, 9.0.18
dotnet8.0 (Red Hat package) - update to 8.0.130-1.el10_0
dotnet9.0 (Red Hat package) - update to 9.0.120-1.el10_0

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170

• Multiple vulnerabilities in Microsoft ASP.NET Core
• Red Hat Enterprise Linux 10 update for .NET 8.0
• Red Hat Enterprise Linux 10 update for .NET 9.0