Critical Security Update for ASP.NET Core Runtime 8.0: Denial of Service Vulnerability
Summary
ALSA-2026:4451: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.25-1.el10_1. Fixed in 8.0.25-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ASP.NET Core is a cross-platform, high-performance framework for building modern, cloud-based, internet-connected applications. It is designed to allow developers to create web applications and services that are scalable and maintainable. The framework includes a rich set of libraries and tools that enhance productivity and performance. However, recent vulnerabilities have been identified that could potentially compromise the security of applications built using this framework.
Vulnerability Detail
The vulnerability identified as CVE-2026-26130 affects ASP.NET Core and allows for a Denial of Service (DoS) attack through uncontrolled resource allocation. This means that an attacker could exploit this vulnerability to consume excessive resources, leading to service unavailability. The issue arises from improper handling of requests, which can be manipulated to exhaust server resources, thereby impacting the availability of the application.
How To Fix
Minimum fixed version
8.0.25-1.el10_1
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement rate limiting on your application to mitigate the impact of potential DoS attacks. This can be done by configuring middleware in your ASP.NET Core application to limit the number of requests from a single client within a specified time frame.
Conclusion
In summary, the recent security update for ASP.NET Core Runtime 8.0 addresses a critical Denial of Service vulnerability. It is crucial for developers to update their packages to the latest patched versions to ensure the security and availability of their applications. Implementing rate limiting can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
CVE-2026-26130 is a security vulnerability in ASP.NET Core that allows for Denial of Service attacks through uncontrolled resource allocation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check if your application is affected.
If exploited, this vulnerability can lead to service unavailability, affecting the performance and reliability of your application.
It is recommended to regularly check for updates and apply security patches as soon as they are released to mitigate vulnerabilities.
Yes, using Vulert's playground, you can monitor your application for vulnerabilities in real-time without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
