The Microsoft Security Response Center describes the weakness as allocation of resources without limits or throttling in ASP.NET Core. Its remediation is specific: For Microsoft.AspNetCore.WebUtilities, update to fixed build 2.3.14 or later.
What the advisory says
- CVE: CVE-2026-118750
- Title: ASP.NET Core Denial of Service Vulnerability
- Severity: Important
- Weakness: CWE-770
- CVSS base score: 7.5
- CVSS temporal score: 6.5
- CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Exploitation assessment: Exploitation Less Likely
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The CVSS vector describes a network-accessible issue requiring neither privileges nor user interaction, with a high impact on availability. Its confidentiality and integrity impact scores are both none. The temporal score adds factors concerning exploit maturity, remediation and report confidence to the base assessment.
What administrators and developers should do
Identify applications that use Microsoft.AspNetCore.WebUtilities, including those that receive it as a transitive dependency. Check the resolved package version rather than relying solely on the dependencies listed directly in a project.
Update the package to the fixed build specified by Microsoft, restore dependencies, and test and redeploy affected applications. Then verify that the deployed application uses the updated dependency. For production services, include availability monitoring in the rollout: the risk described by the advisory is disruption, so confirming that the service remains healthy after deployment is useful operational practice.
Microsoft’s Exploitation Less Likely assessment is not a substitute for applying the fix. The advisory identifies a network-reachable availability risk and explicitly calls for customer action.