DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-69304: CVE-2026-69304: Denial of Service via Request Decompression Data Amplification in ASP.NET Core

#security #cve #cybersecurity

CVE-2026-69304: Denial of Service via Request Decompression Data Amplification in ASP.NET Core

Vulnerability ID: CVE-2026-69304
CVSS Score: 5.9
Published: 2026-09-09

An Improper Handling of Highly Compressed Data (Data Amplification) vulnerability (CVE-2026-69304) exists in Microsoft ASP.NET Core and Microsoft .NET. It allows unauthenticated remote attackers to trigger resource exhaustion and denial of service via highly compressed request payloads.

TL;DR

A Medium severity (CVSS 5.9) denial-of-service vulnerability in ASP.NET Core allows unauthenticated attackers to cause memory exhaustion and crash the server via compressed HTTP request payloads.

Technical Details

  • CWE ID: CWE-409
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 5.9 (Medium)
  • EPSS Score: 0.00768
  • Impact: Availability (High)
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 10.0
  • Microsoft .NET 9.0
  • Microsoft .NET 8.0
  • ASP.NET Core 11.0
  • ASP.NET Core 10.0
  • ASP.NET Core 9.0
  • ASP.NET Core 8.0
  • Visual Studio 2022 (v17.14)
  • Visual Studio 2026 (v18.9)
  • .NET 10.0: 10.0.0 to < 10.0.12 (Fixed in: 10.0.12)
  • .NET 9.0: 9.0.0 to < 9.0.20 (Fixed in: 9.0.20)
  • .NET 8.0: 8.0.0 to < 8.0.31 (Fixed in: 8.0.31)
  • ASP.NET Core 11.0: 11.0 to < 11.0 RC1 (Fixed in: 11.0 RC1)
  • ASP.NET Core 10.0: 10.0.0 to < 10.0.12 (Fixed in: 10.0.12)
  • ASP.NET Core 9.0: 9.0.0 to < 9.0.20 (Fixed in: 9.0.20)
  • ASP.NET Core 8.0: 8.0.0 to < 8.0.31 (Fixed in: 8.0.31)
  • Visual Studio 2022 (v17.14): 17.14.0 to < 17.14.40 (Fixed in: 17.14.40)
  • Visual Studio 2026 (v18.9): 18.9.0 to < 18.9.3 (Fixed in: 18.9.3)

Code Analysis

Commit: 9263176

Updates package dependencies for runtime, WebAssembly SDK, EntityFramework, and security packages to version 10.0.12.

Commit: 061d555

Integrates builds from dotnet/dotnet incorporating the updated request decompression stream checks in Servicing build 26380.110.

Commit: ee6176b

Dependency update linking patched servisings for browser transport and host factory modules.

Mitigation Strategies

  • Upgrade the host .NET Runtime and SDK to version 10.0.12, 9.0.20, or 8.0.31 respectively.
  • Disable request decompression middleware (app.UseRequestDecompression()) globally if not actively required.
  • Enforce explicit request body limits (MaxRequestBodySize) inside Kestrel configuration.
  • Configure WAF rules or reverse proxies to reject or strip compressed headers (Content-Encoding) on unauthenticated routes.

Remediation Steps:

  1. Identify all ASP.NET Core deployment environments utilizing request decompression middleware.
  2. Apply Microsoft .NET framework cumulative updates to target servers.
  3. In corporate SDK repositories, update global project configurations to target .NET SDK 10.0.12+, 9.0.20+, or 8.0.31+.
  4. Where instant patching is unavailable, edit the Program.cs or Startup.cs configuration files to remove the 'app.UseRequestDecompression()' middleware directive.
  5. Add Kestrel server option limits for request body sizes inside the hosting startup sequence.

References

Read the full report for CVE-2026-69304 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)