cve 2026 26130

CVE-2026-26130 is a denial-of-service vulnerability in ASP.NET Core, classified as an allocation-of-resources-without-limits issue that can be triggered remotely to make ASP.NET Core applications unavailable. Microsoft addressed this weakness in the March 10, 2026 servicing updates, which include targeted fixes for the runtime and ASP.NET Core packages. Administrators and developers are advised to prioritize applying these updates and to implement operational throttling while assessing exposure and detection posture. The vulnerability affects ASP.NET Core applications and requires prompt patching to maintain availability.