CVE-2026-96236: Microsoft.AspNetCore.App.Runtime Denial of Service Vulnerability
Summary
CVE-2026-96236: Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability. Affects Microsoft.AspNetCore.App.Runtime.linux-arm across 4 version ranges.
>= 8.0.0, < 8.0.32
>= 9.0.0, < 9.0.21
>= 10.0.0, < 10.0.13
>= 11.0.0-preview.1, < 11.0.0-rc.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.AspNetCore.App.Runtime is a set of libraries that provide essential functionalities for building web applications using ASP.NET Core. It supports various platforms, including Windows, Linux, and macOS, and is widely used for developing modern web applications. This package allows developers to leverage features such as request localization, which enhances user experience by adapting content based on user culture settings. However, a vulnerability has been identified that can lead to denial of service due to unbounded memory growth.
Vulnerability Detail
The vulnerability arises from the ASP.NET Core request-localization fallback mechanism, which can accept attacker-supplied synthetic culture names. This allows unauthenticated requests to manipulate the runtime's global cache, leading to unbounded memory growth. As a result, an attacker can exploit this vulnerability to cause a denial of service, potentially crashing the application or making it unresponsive. The vulnerability is categorized under CWE-770, which pertains to the allocation of resources without limits or throttling.
How To Fix
Latest published version: 10.0.13 as of 23 Oct 2026
The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.0.328.0.32 -
>= 9.0.0, < 9.0.219.0.21 -
>= 11.0.0-preview.1, < 11.0.0-rc.211.0.0-rc.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to restrict the culture names accepted by your application. This can help mitigate the risk of unbounded memory growth until the package can be updated.
Conclusion
In summary, CVE-2026-96236 is a denial of service vulnerability affecting the Microsoft.AspNetCore.App.Runtime package. It allows unauthenticated requests to manipulate the runtime's global cache, leading to potential application crashes. Developers are advised to update to the patched version to mitigate this risk.
See every vulnerability recorded for Microsoft.AspNetCore.App.Runtime.linux-arm →
FAQ
If your application uses any of the affected package versions listed in the advisory, it is vulnerable.
The vulnerability affects applications running on Windows, Linux, and macOS.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It requires only the packages.config file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.AspNetCore.App.Runtime.linux-arm.
