Critical Security Update for ASP.NET Core Runtime 8.0: Denial of Service Vulnerability
Summary
ALSA-2026:4455: Important: .NET 8.0 security update. Affects aspnetcore-runtime-8.0 versions < 8.0.25-1.el8_10. Fixed in 8.0.25-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ASP.NET Core is a cross-platform, high-performance framework for building modern, cloud-based, Internet-connected applications. It allows developers to create web applications and services with a modular architecture. The framework is designed to be lightweight and flexible, making it suitable for a variety of applications. However, a recent security vulnerability has been identified in the ASP.NET Core Runtime 8.0, which could lead to a Denial of Service (DoS) attack due to uncontrolled resource allocation.
Vulnerability Detail
The vulnerability, identified as CVE-2026-26130, arises from improper handling of resource allocation within ASP.NET Core. An attacker can exploit this flaw to cause excessive resource consumption, leading to a Denial of Service condition. This could result in the application becoming unresponsive, affecting availability and potentially leading to data loss or service disruption. The vulnerability is critical as it can be triggered remotely without requiring authentication.
How To Fix
Minimum fixed version
8.0.25-1.el8_10
This is the first release that contains the fix.
sudo dnf update aspnetcore-runtime-8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to limit the resources allocated to the application and implement rate limiting to reduce the impact of potential attacks. Additionally, monitoring application performance and resource usage can help identify unusual patterns that may indicate an ongoing attack.
Conclusion
The recent security update for ASP.NET Core Runtime 8.0 addresses a critical vulnerability that could lead to Denial of Service attacks. It is crucial for developers and system administrators to update their packages to the latest versions to mitigate risks. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for aspnetcore-runtime-8.0 →
FAQ
CVE-2026-26130 is a security vulnerability in ASP.NET Core Runtime 8.0 that allows for Denial of Service attacks due to uncontrolled resource allocation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to Denial of Service, making the application unresponsive and potentially causing data loss.
It is recommended to regularly check for updates and apply them promptly to ensure your application is protected against known vulnerabilities.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for aspnetcore-runtime-8.0.
