CVE-2026-114149 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2026-114149

CVE-2026-114149

Published:November 10, 2026

Updated:November 12, 2026

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected Packages

Microsoft.AspNetCore.WebUtilities (DOT_NET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

Microsoft.AspNetCore.WebUtilities (DOT_NET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

Microsoft.AspNetCore.WebUtilities (DOT_NET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

Microsoft.AspNetCore.WebUtilities (DOT_NET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

https://github.com/dotnet/dotnet.git (GITHUB):

Affected version(s) >=v11.0.0-preview.1.26104.118 <v11.0.0 || >=v11.0.0-rc.1.26425.128 <v11.0.0

Fix Suggestion:

Update to version v11.0.0

https://github.com/dotnet/dotnet.git (GITHUB):

Affected version(s) >=v10.0.0-rc.1.25451.107 <v10.0.15

Fix Suggestion:

Update to version v10.0.15

https://github.com/dotnet/aspnetcore.git (GITHUB):

Affected version(s) >=v9.0.0-rc.1.24452.1 <v9.0.23

Fix Suggestion:

Update to version v9.0.23

https://github.com/dotnet/aspnetcore.git (GITHUB):

Affected version(s) >=v8.0.0-rc.1.23421.29 <v8.0.34

Fix Suggestion:

Update to version v8.0.34

microsoft.aspnetcore.webutilities (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.webutilities (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.webutilities (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.webutilities (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=9.0.0-rc.1.24452.1 <9.0.23

Fix Suggestion:

Update to version 9.0.23

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=11.0.0-preview.1.26104.118 <11.0.0 || >=11.0.0-rc.1.26425.128 <11.0.0

Fix Suggestion:

Update to version 11.0.0

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=10.0.0-rc.1.25451.107 <10.0.15

Fix Suggestion:

Update to version 10.0.15

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=8.0.0-rc.1.23421.29 <8.0.34

Fix Suggestion:

Update to version 8.0.34

Related Resources (16)

https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0

https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md

https://github.com/dotnet/announcements/issues/511

https://github.com/dotnet/aspnetcore/commit/e2fdf87f23ce5747bce1ac9a8c34905b17799a68

https://github.com/dotnet/aspnetcore/commit/eea3265c048c88f9c064fc1ff2b3be9570b6f8cc

https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15

https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23

https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md

https://github.com/dotnet/aspnetcore/security/advisories/GHSA-x33c-w48q-qrgc

https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md

https://github.com/dotnet/aspnetcore

https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md

https://github.com/dotnet/aspnetcore/discussions/70473

https://nvd.nist.gov/vuln/detail/CVE-2026-114149

https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114149

Do you need more information?

CVSS v4

Base Score:

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

NONE

Vulnerable System Integrity

NONE

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Exploit Maturity

UNPROVEN

Weakness Type (CWE)

Allocation of Resources Without Limits or Throttling

CWE-770

EPSS

Base Score:

1.30

AI app security

Mend AI

Application security

Mend AppSec

Dependency management

Mend Renovate

Expand coverage

Runtime and beyond

AI security

Code security

Supply chain security

Compliance & reporting

vs. AI security tools

vs. AppSec tools

Buyer’s guides

About Mend.io

Partners & people

Customers

Learn & explore

Guides

Developers hub