JEDI-SEC | Security Research & Digital Defense

GHSA-3893-7fxc-qvff: Microsoft Security Advisory CVE-2026-114154 – ASP.NET Core Denial of Service Vulnerability

Written by

jedisec_u136k7

in

  • Severity: MEDIUM
  • CVE: CVE-2026-114154
  • Ecosystems: nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget, nuget
  • Packages: Microsoft.AspNetCore.Server.HttpSys, Microsoft.AspNetCore.Server.HttpSys, Microsoft.AspNetCore.Server.HttpSys, Microsoft.AspNetCore.Server.HttpSys, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

Malformed chunked HttpSys requests containing conflicting content-length headers can retain request and connection resources.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/513

## CVSS Details

– **Version:** 3.1
– **Severity:** High
– **Score:** 7.5 (base score)
– **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`
– **Weakness:** CWE-401

## Affected Platforms

– **Platforms:** Windows
– **Architectures:** All

## Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

### ASP.NET Core 2.3 – standalone packages

Package | Affected version | Patched version
— | — | —
[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.10 | 2.3.14
[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.11 | 2.3.14
[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.12 | 2.3.14
[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.13 | 2.3.14

### .NET 8.0 – affected runt…

Source: GitHub Security Advisories · 2026-11-11

More posts