CVE-2026-118748: Unbounded Memory Allocation Denial of Service in ASP.NET Core Blazor Static-SSR

Vulnerability ID: CVE-2026-118748
CVSS Score: 7.5
Published: 2026-11-11

CVE-2026-118748 is a remote Denial of Service (DoS) vulnerability in Microsoft ASP.NET Core (.NET 11.0 preview releases prior to 11.0.0) and Microsoft Visual Studio 2026 (prior to 18.12.0). The flaw originates from unbounded resource allocation (CWE-770) within the Blazor static server-side rendering (static-SSR) validation pipeline, where dynamic or attacker-supplied form field identifiers are cached in a singleton-scoped memory structure without size limits or eviction policies. Unauthenticated remote attackers can exploit this condition over the network by sending repeated HTTP requests with unique field names, exhausting heap memory and terminating the host process via an unhandled OutOfMemoryException.

TL;DR

An unauthenticated remote attacker can trigger a Denial of Service (OutOfMemoryException) in ASP.NET Core (.NET 11.0 previews) by submitting HTTP requests with arbitrary form field names to Blazor static-SSR endpoints, causing unbounded growth in a singleton-scoped validation cache.

Technical Details

• CVE ID: CVE-2026-118748
• Weakness Class: CWE-770 (Allocation of Resources Without Limits or Throttling)
• Affected Component: ASP.NET Core Blazor Static-SSR Client-Side Validation Cache
• Attack Vector: Network (Unauthenticated HTTP Form Submissions)
• CVSS v3.1 Score: 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• Primary Impact: Remote Denial of Service via Heap Exhaustion (OutOfMemoryException)
• Exploit Status: Unproven (No Public PoC)
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft .NET 11.0 (Linux, macOS, Windows)
• Microsoft ASP.NET Core 11.0 (Blazor static-SSR)
• Microsoft Visual Studio 2026 (Windows)
• .NET 11.0 (Linux, macOS, Windows): >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
• Microsoft Visual Studio 2026: < 18.12.0 (Fixed in: 18.12.0)

Mitigation Strategies

• Upgrade the .NET Runtime and ASP.NET Core shared framework to the general availability release 11.0.0 or later.
• Restrict per-request form parameter counts and key lengths using ASP.NET Core FormOptions (ValueCountLimit and KeyLengthLimit).
• Apply strict rate limiting on HTTP POST endpoints utilizing Blazor static server-side rendering (static-SSR).
• Ensure internal or custom validation caches bind metadata to request lifetimes (Scoped) or use bounded MemoryCache instances with explicit SizeLimit and TTL configurations.

Remediation Steps:

1. Inventory all hosts, containers, and build agents running .NET 11.0 preview builds (< 11.0.0) or Visual Studio 2026 (< 18.12.0) via dotnet --list-runtimes.
2. Download and install the official .NET 11.0.0 SDK and ASP.NET Core Runtime packages from Microsoft's official distribution channels.
3. Update Visual Studio 2026 installations to version 18.12.0 or later via the Visual Studio Installer.
4. Rebuild and redeploy any self-contained ASP.NET Core deployments (--self-contained true) so the patched framework assemblies are bundled into the application artifacts.
5. Verify the runtime version in production environments and monitor .NET Gen 2 heap size metrics (dotnet-counters monitor --counters System.Runtime) to confirm memory stability.

References

• Microsoft Security Update Guide Advisory: CVE-2026-118748
• CVE.org Official Record: CVE-2026-118748
• National Vulnerability Database (NVD) Detail: CVE-2026-118748
• ASP.NET Core v11.0.0 Official Release Tag
• MITRE ATT&CK Search Mapping for CVE-2026-118748
• Shodan CVEDB Entry: CVE-2026-118748
• CISA Known Exploited Vulnerabilities (KEV) Catalog

Read the full report for CVE-2026-118748 on our website for more details including interactive diagrams and full exploit analysis.