CVE-2026-114150: Remote Information Disclosure via Uninitialized Pooled Memory in ASP.NET Core Response Buffering

Vulnerability ID: CVE-2026-114150
CVSS Score: 5.9
Published: 2026-11-11

CVE-2026-114150 is a network-accessible information disclosure vulnerability affecting Microsoft ASP.NET Core in .NET 11.0 preview releases and Microsoft Visual Studio 2026 prior to version 18.12.0. The flaw stems from the use of uninitialized resources (CWE-908) within response buffering components, specifically ResponseBufferingStream used by middleware such as HTTP Logging and Output Caching. Because rented memory segments from ArrayPool or MemoryPool are not cleared upon return or strictly bounded to the exact written byte count during subsequent reads, residual response payloads from earlier HTTP requests remain in the buffer tail. Downstream consumers or log sinks reading these buffers expose confidential cross-session data, including authentication tokens and personally identifiable information.

TL;DR

An uninitialized memory reuse flaw (CWE-908) in ASP.NET Core 11.0 preview response buffering middleware allows residual HTTP response data from pooled memory buffers to leak into subsequent short responses or application log sinks. Upgrading to .NET 11.0.0 GA or Visual Studio 2026 18.12.0 resolves the issue.

Technical Details

• CVE ID: CVE-2026-114150
• Weakness Class: CWE-908 (Use of Uninitialized Resource)
• CVSS v3.1 Score: 5.9 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
• Attack Vector: Network (HTTP/HTTPS Response Buffering)
• Primary Impact: High Confidentiality Loss (Cross-Request Memory & Log Disclosure)
• Affected Component: ASP.NET Core ResponseBufferingStream / HttpLogging & OutputCaching
• Exploit Status: Unproven / No Public PoC
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft .NET 11.0 (Linux, macOS, Windows)
• Microsoft ASP.NET Core 11.0 Preview Builds
• Microsoft Visual Studio 2026 (Version 18.12)
• .NET 11.0 (Linux, macOS, Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
• Visual Studio 2026: < 18.12.0 (Fixed in: 18.12.0)

Mitigation Strategies

• Upgrade all .NET 11.0 preview installations (.NET 11.0.0-preview.1 through RC builds) to the official .NET 11.0.0 General Availability (GA) release.
• Update Microsoft Visual Studio 2026 development environments to version 18.12.0 or later.
• Disable HTTP response body logging in HttpLoggingMiddleware by removing HttpLoggingFields.ResponseBody and avoiding HttpLoggingFields.All in application startup configurations.
• Audit custom Stream and IHttpResponseBodyFeature implementations to ensure all ArrayPool and MemoryPool rentals are strictly sliced to actual written byte counts and cleared upon return.

Remediation Steps:

1. Inventory all servers, virtual machines, and container images running Microsoft.AspNetCore.App versions matching 11.0.0-preview.*
2. Download and install the .NET 11.0.0 GA runtime, ASP.NET Core Hosting Bundle, or SDK from Microsoft's official distribution channels.
3. Rebuild and redeploy containerized ASP.NET Core applications using the patched mcr.microsoft.com/dotnet/aspnet:11.0 base image.
4. Update Microsoft Visual Studio 2026 to version 18.12.0 on all developer workstations and CI/CD build nodes.
5. Inspect historical application logs generated by affected preview builds and purge or rotate any credentials, API keys, or session tokens that may have leaked into trailing log entries.

References

• Microsoft Security Response Center (MSRC) Advisory: CVE-2026-114150
• Official CVE.org Record: CVE-2026-114150
• National Vulnerability Database (NVD): CVE-2026-114150
• ASP.NET Core v11.0.0 Official Release Notes
• MITRE CWE-908: Use of Uninitialized Resource
• Shodan CVEDB Entry: CVE-2026-114150
• CISA Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK Framework Search

Read the full report for CVE-2026-114150 on our website for more details including interactive diagrams and full exploit analysis.