{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/microsoft.aspnetcore.app.runtime.osx-x64/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-96236"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft.AspNetCore.App.Runtime.linux-arm","Microsoft.AspNetCore.App.Runtime.linux-arm64","Microsoft.AspNetCore.App.Runtime.linux-musl-arm","Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","Microsoft.AspNetCore.App.Runtime.linux-musl-x64","Microsoft.AspNetCore.App.Runtime.linux-x64","Microsoft.AspNetCore.App.Runtime.osx-arm64","Microsoft.AspNetCore.App.Runtime.osx-x64","Microsoft.AspNetCore.App.Runtime.win-arm","Microsoft.AspNetCore.App.Runtime.win-arm64","Microsoft.AspNetCore.App.Runtime.win-x64","Microsoft.AspNetCore.App.Runtime.win-x86"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMicrosoft has disclosed a high-severity denial-of-service (DoS) vulnerability (CVE-2026-96236) impacting the Microsoft.AspNetCore.Localization component within ASP.NET Core. The vulnerability stems from improper handling of request-localization fallbacks, where the application cache fails to limit the registration of synthetic culture names supplied by unauthenticated users.\u003c/p\u003e\n\u003cp\u003eAn attacker can repeatedly send crafted requests containing arbitrary, synthetic culture strings to the application. Because these strings are added to the runtime's global cache without adequate throttling or capacity limits, the process memory usage grows indefinitely. This unbounded consumption eventually leads to an out-of-memory (OOM) condition, causing the service to crash or become unresponsive. This flaw affects multiple .NET versions, including 8.0, 9.0, 10.0, and 11.0 previews. Defenders must prioritize patching the .NET SDK and runtime to the specified security versions to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete denial of service for affected web applications due to memory exhaustion. The vulnerability is exploitable by unauthenticated remote attackers, making internet-facing ASP.NET Core services highly susceptible to disruption. There are no reports of data exfiltration or arbitrary code execution; however, the ease of triggering memory growth poses a significant risk to availability across all environments (Windows, Linux, and macOS).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all affected ASP.NET Core applications to the patched runtime versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.\u003c/li\u003e\n\u003cli\u003eFor self-contained deployments, recompile and redeploy the applications after updating the SDK references to ensure the patch is included in the application bundle.\u003c/li\u003e\n\u003cli\u003eUse the \u003ccode\u003edotnet --info\u003c/code\u003e command to audit installed runtimes and identify applications requiring maintenance.\u003c/li\u003e\n\u003cli\u003eImplement request rate limiting at the web server or load balancer level to mitigate potential automated attempts to exhaust memory until patching can be completed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T00:32:36Z","date_published":"2026-10-14T00:32:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aspnet-core-dos/","summary":"A memory exhaustion vulnerability in Microsoft.AspNetCore.Localization allows unauthenticated attackers to cause unbounded memory growth and denial of service in ASP.NET Core applications.","title":"ASP.NET Core Denial of Service via Resource Exhaustion","url":"https://feed.craftedsignal.io/briefs/2026-10-aspnet-core-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Microsoft.AspNetCore.App.Runtime.osx-X64","version":"https://jsonfeed.org/version/1.1"}