CVE-2026-96236

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

This vulnerability is rated as Important severity because an unauthenticated remote attacker can exploit it over standard network connections to exhaust application memory without requiring any specialized privileges. In deployments where ASP.NET Core web services use request localization, handling incoming requests with arbitrarily generated culture identifiers populates internal runtime caches without proper bounds. Over time or through an automated flood of requests, this excessive memory allocation leads to application crashes and service outages on host systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.