Key points
- CVE-2026-96236 allows unauthorized attackers to deny service via network requests.
- The flaw affects ASP.NET Core versions 8 through 11 preview releases.
- Microsoft has released patched versions for all affected .NET runtime packages.
Microsoft has addressed a high-severity denial-of-service vulnerability in ASP.NET Core that impacts organizations running web applications on .NET versions 8 through 11. The flaw, tracked as CVE-2026-96236, exists in the Microsoft.AspNetCore.Localization component. According to the Microsoft Security Update Guide, an unauthorized attacker can exploit this issue over a network to deny service. The vulnerability stems from the allocation of resources without limits or throttling.
By the numbers
- CVSS 3.1 score of 7.5, rated high severity by Microsoft.
- Affected versions span from 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1.
- Patched versions include 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
What the figures mean
The vulnerability allows unauthenticated requests to cause unbounded memory growth. According to the GitHub advisory, the request-localization fallback mechanism can add attacker-supplied synthetic culture names to the runtime's global cache. This behavior consumes memory without limit, leading to denial of service. The issue affects Windows, Linux, and macOS platforms across all architectures. That suggests any public-facing ASP.NET Core application using localization features is potentially exposed until updated.
What should you do?
Managed service providers should immediately inventory client environments running ASP.NET Core versions 8 through 11. Check package dependencies for Microsoft.AspNetCore.App.Runtime packages on Linux, macOS, and Windows. Verify current versions against the vulnerable ranges listed in the advisory. Prioritize updating to the patched versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2. Monitor application logs for unusual memory consumption patterns that might indicate exploitation attempts.
Operational impact
Teams usually need to coordinate with development and operations groups to schedule updates for production systems. Check whether any client applications rely on localization features that might be affected by this cache behavior. Determine who inside the organization needs to be notified about the risk, including security leads and application owners. Establish a timeline for deploying the patched versions to minimize exposure. Ensure that change management processes are followed to avoid service disruptions during the update.
What to do and how to stay safe: Microsoft
- Audit all managed environments for ASP.NET Core versions 8.0.0 through 11.0.0-rc.1.
- Update Microsoft.AspNetCore.App.Runtime packages to the patched versions listed in the advisory.
- Monitor server memory usage for signs of unbounded growth from localization requests.
- Review client applications to confirm they are not using vulnerable localization fallback logic.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96236?
It is a high-severity denial-of-service vulnerability in ASP.NET Core that allows unauthenticated attackers to cause unbounded memory growth.
Which versions are affected?
Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are affected.
Is there a fix available?
Yes, Microsoft has released patched versions 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
