CVE-2026-118750: Uncontrolled Resource Allocation in ASP.NET Core FileBufferingReadStream

Vulnerability ID: CVE-2026-118750
CVSS Score: 7.5
Published: 2026-11-10

CVE-2026-118750 is an uncontrolled resource allocation vulnerability (CWE-770) affecting the Microsoft.AspNetCore.WebUtilities component in ASP.NET Core. Specifically, the FileBufferingReadStream class eagerly allocates large memory buffers from the shared ArrayPool inside its constructor prior to reading any incoming request payload data. An unauthenticated remote attacker can exploit this behavior by opening numerous concurrent connections and stalling or omitting request body transmission, exhausting shared memory pools and causing a server-wide Denial of Service (DoS).

TL;DR

An unauthenticated remote attacker can trigger an application-level Denial of Service in ASP.NET Core web applications using Microsoft.AspNetCore.WebUtilities (< 2.3.14) by initiating concurrent buffered HTTP requests that prematurely exhaust the shared ArrayPool via eager constructor allocations in FileBufferingReadStream.

Technical Details

• CVE ID: CVE-2026-118750
• Weakness Class: CWE-770 (Allocation of Resources Without Limits or Throttling)
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• Affected Component: Microsoft.AspNetCore.WebUtilities (FileBufferingReadStream)
• Vulnerable Versions: >= 2.3.12, < 2.3.14
• Patched Version: 2.3.14
• Primary Impact: Endpoint Denial of Service (Memory Pool Exhaustion)
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft.AspNetCore.WebUtilities
• ASP.NET Core
• Microsoft.AspNetCore.WebUtilities: >= 2.3.12, < 2.3.14 (Fixed in: 2.3.14)

Code Analysis

Commit: 9a26c74

Merged PR 67040: [release 2.3] Make FileBufferingReadStream lazily rent buffer

File: src/Http/WebUtilities/src/FileBufferingReadStream.cs
@@ -27,7 +27,6 @@ public class FileBufferingReadStream : Stream
         private string _tempFileName;

         private Stream _buffer;
-        private byte[] _rentedBuffer;
         private bool _inMemory = true;
         private bool _completelyBuffered;

@@ -62,9 +61,7 @@ public FileBufferingReadStream(
             _bytePool = bytePool;
             if (memoryThreshold < _maxRentedBufferSize)
             {
-                _rentedBuffer = bytePool.Rent(memoryThreshold);
-                _buffer = new MemoryStream(_rentedBuffer);
-                _buffer.SetLength(0);
+                _buffer = new PooledMemoryStream(bytePool, memoryThreshold);
             }
             else
             {

Mitigation Strategies

• Upgrade Microsoft.AspNetCore.WebUtilities to version 2.3.14 or higher to replace eager ArrayPool allocations with lazy, geometrically scaling PooledMemoryStream allocations.
• Enforce strict MinRequestBodyDataRate and MaxConcurrentConnections limits in Kestrel to rapidly terminate idle or slowloris-style HTTP connections.
• Enable request body buffering and aggressive client body read timeouts on upstream reverse proxies (e.g., NGINX, HAProxy, Azure Application Gateway) to prevent incomplete requests from reaching the ASP.NET Core backend.
• Restrict request buffering (EnableBuffering) and multipart form processing solely to endpoints that strictly require them, and apply authentication checks prior to reading or buffering request streams.

Remediation Steps:

1. Audit all .NET projects and dependency trees for references to Microsoft.AspNetCore.WebUtilities versions >= 2.3.12 and < 2.3.14.
2. Update the PackageReference for Microsoft.AspNetCore.WebUtilities to version 2.3.14 in affected .csproj or Directory.Packages.props files.
3. Rebuild, test, and redeploy the affected ASP.NET Core applications.
4. Verify Kestrel server options and reverse proxy configurations to ensure connection concurrency limits and body read timeouts are enforced.

References

• Microsoft Security Update Guide: CVE-2026-118750
• CVE.org Official Record: CVE-2026-118750
• GitHub Commit 9a26c7414a4fbff45535c0830253c1b4479b0073: Make FileBufferingReadStream lazily rent buffer
• MITRE ATT&CK Tactic: Impact (TA0040)
• MITRE ATT&CK Search for CVE-2026-118750
• Shodan CVEDB Entry: CVE-2026-118750

Read the full report for CVE-2026-118750 on our website for more details including interactive diagrams and full exploit analysis.