CVE-2026-69304
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
- EPSS probability
- 0.77%
- CWE
- CWE-409
- Published
- 2026-09-08
- Last modified
- 2026-09-10
Affected products
- Microsoft .NET 10.0
- Microsoft .NET 8.0
- Microsoft .NET 9.0
- Microsoft ASP.NET Core 10.0
- Microsoft ASP.NET Core 11.0
- Microsoft ASP.NET Core 8.0
- Microsoft ASP.NET Core 9.0
- Microsoft Microsoft Visual Studio 2022 version 17.14
Weakness type
Related vulnerabilities
- CVE-2026-79695 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-85786 — Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
- CVE-2026-82520 — parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
- CVE-2026-84382 — HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
- CVE-2026-78594 — Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
- CVE-2026-72628 — Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
- CVE-2026-82864 — pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
- CVE-2026-58107 — Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun