Brief Summary: ASP.NET Core CVE-2026-118749, Quadratic Minimal API Validation Denial of Service (CWE-407)

Introduction

A flaw in the validation layer of ASP.NET Core Minimal APIs lets an unauthenticated remote client make a server spend CPU time that grows quadratically with the number of invalid items in a request body. Because Microsoft says that work keeps running after the client disconnects, an attacker can send a request and walk away, which turns a single cheap payload into sustained load on any exposed endpoint built on an affected .NET 11 release candidate.

Microsoft rates CVE-2026-118749 at CVSS 3.1 base 7.5 (High), classifies it as CWE-407, Inefficient Algorithmic Complexity, and fixed it in the .NET 11.0.0 / ASP.NET Core 11.0.0 general availability release shipped with the November 10, 2026 servicing updates. The impact is availability only: no confidentiality or integrity impact is scored. Only the .NET 11 release candidate line is affected.

Technical information

Root cause

Microsoft's advisory places the bug in the validation used by Minimal APIs. According to the advisory, the validator repeatedly copies a growing dictionary of validation errors, so an attacker who sends large collections can trigger "quadratic CPU work after the client disconnects."

Microsoft's validation documentation explains that Minimal APIs run the validation service before the endpoint handler executes, and that AddValidation enables automatic validation of supported parameters, including properties and objects described with data annotations on bound models. That is the execution path where the flawed error accumulation happens. It does not make every Minimal API application exposed. The risk concentrates on endpoints that use the built-in validation and bind collections from the request body.

Why the cost is quadratic

The arithmetic follows directly from Microsoft's description:

• Each invalid element in a bound collection adds an entry to the error dictionary.
• If the whole dictionary is copied every time an error is added, error k costs roughly k operations.
• For n errors, the total is roughly n²/2 operations, which is O(n²).
• A request body with tens of thousands of invalid items is cheap for the client to produce and send, but it can occupy a server thread for a very long time.

The work also persists, which separates this from a typical slow-request problem. In the vulnerable behavior Microsoft describes, closing the connection does not stop the validation work. An attacker does not need to hold sockets open the way a slow-body attack would. They can fire requests and move on while the server keeps grinding through the error dictionary copies. The advisory does not quantify how long the processing runs or publish a benchmark.

CVSS breakdown

Microsoft's base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H:

• Attack vector: Network. Reachable remotely.
• Attack complexity: Low.
• Privileges required: None.
• User interaction: None.
• Scope: Unchanged.
• Confidentiality and Integrity: None.
• Availability: High.

The extended vector in Microsoft's announcement adds E:U/RL:O/RC:C: exploit code maturity Unproven, an official fix available, and confirmed report confidence. Nothing in the scoring suggests code execution or data exposure.

Attack flow

Based on the advisory's description, exploitation would look like this:

1. The attacker identifies a Minimal API endpoint on an affected .NET 11 release candidate that uses the built-in validation and accepts a collection in the request body.
2. The attacker builds a body containing a very large collection whose elements are each crafted to fail validation, so every element produces a validation error.
3. The attacker sends the request and can disconnect immediately.
4. The server binds the model, enters validation, and copies the growing error dictionary once per error, performing roughly n²/2 operations for n errors. This continues after the client is gone.
5. Repeating the request ties up additional worker threads and CPU, degrading latency and availability for all users of the instance.

The public sources do not provide a triggering HTTP request, endpoint path, payload size, performance threshold or reproduction code, so we cannot be more specific than this outline.

Exploitation status

No source we reviewed establishes exploitation in the wild or names a threat actor. OffSeq Threat Radar's record, current at 00:20 UTC on November 11, 2026, reports no exploitation evidence on record, no CISA KEV listing, no public exploit code indexed in Metasploit or Exploit DB, no public Nuclei template, and no attack traffic on its Mirage sensors. Tenable's plugin pages likewise state that no known exploits are available. These are bounded observations from specific sources at a specific time. Given the low complexity and unauthenticated network vector, they should not be read as evidence of safety. The advisory acknowledges Alejandro Pacheco and Artur Stetsko for the report. That credits the researchers who reported the bug and does not attribute any attack.

Patch information

What was fixed. Microsoft fixed CVE-2026-118749 in the GA release of .NET 11.0.0 / ASP.NET Core 11.0.0, shipped with the November 10, 2026 servicing updates. The advisory names 11.0.0 as the first patched version for every listed package. The .NET 11.0.0 release notes list CVE-2026-118749 among the security fixes and list Microsoft.Extensions.Validation 11.0.0 and all Microsoft.AspNetCore.App.Runtime.* 11.0.0 packs among the updated packages. The matching SDK is 11.0.100, which the release notes say Visual Studio 18.12.0 includes.

How the fix works. Microsoft has not published the source diff, and none of the fetched sources link a commit or pull request. The GHSA references point to the dotnet/aspnetcore release tag v11.0.0, but that tag returned 404 through the GitHub releases API when checked, so the exact change cannot be quoted. From the advisory's description, the fix has to stop recopying the full dictionary on every error. Errors need to be added to the result in place, or merged once at the end, which brings the cost back to linear in the number of errors. Since the advisory specifically mentions work continuing after disconnect, it would also make sense for the validation loop to observe the request-aborted signal. That part is our inference, and Microsoft has not confirmed it.

Where the fix ships. The patched code ships in two places, and you need to update both if you use both:

• Shared framework / runtime packs: Microsoft.AspNetCore.App.Runtime.{linux-arm, linux-arm64, linux-musl-arm, linux-musl-arm64, linux-musl-x64, linux-x64, osx-arm64, osx-x64, win-arm64, win-x64, win-x86}, fixed in 11.0.0.
• Standalone validation library: Microsoft.Extensions.Validation, fixed in 11.0.0.

Applying the patch correctly. The advisory calls out three details that are easy to miss:

• Self-contained apps. These carry their own copy of the runtime. Updating the machine-wide runtime does not fix them, so rebuild and redeploy them against 11.0.0.
• Direct Microsoft.Extensions.Validation references. You must bump these to 11.0.0 yourself. Installing a new SDK does not change an application's standalone package references.
• Restart. Restart running applications after updating so the fixed binaries are actually loaded.

To check a host, look for 11.0.0 in the ASP.NET Core runtime lines of:

dotnet --list-runtimes

Then confirm that every project's lock file or .csproj resolves Microsoft.Extensions.Validation to 11.0.0 or later. Microsoft's advisory does not offer a workaround, configuration-only fix or request filtering signature. The update and redeployment steps are the documented remediation.

Detection methods

The public material lets you find vulnerable deployments; it does not let you confirm exploitation. None of the sources we reviewed publish IoCs, YARA, Sigma, Snort or Suricata signatures, or attack log patterns for this CVE. Detection is mainly an inventory exercise, supplemented by behavioral monitoring derived from the root cause.

1. Version-based exposure checks

Microsoft's advisory answers "How do I know if I am affected?" directly: compare deployed runtime and application package versions against >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148. Check two kinds of components:

• Shared runtime packages: Microsoft.AspNetCore.App.Runtime.* for every RID: linux-arm, linux-arm64, linux-musl-arm, linux-musl-arm64, linux-musl-x64, linux-x64, osx-arm64, osx-x64, win-arm64, win-x64 and win-x86.
• Standalone validation package: Microsoft.Extensions.Validation, which applications can reference independently and which an SDK update does not touch.

The main blind spot is self-contained applications. A host scan that only inspects the installed shared framework can report a server as clean while a self-contained app on it still runs a vulnerable release candidate runtime. Inventory should cover:

• installed shared runtimes on hosts
• NuGet references in project and lock files, or in SBOMs
• the published output of self-contained or containerized apps, where the runtime travels with the app

2. Commercial scanner coverage

Tenable has published plugin ID 478934, "SCA: security update for Microsoft.AspNetCore.App.Runtime.* … Microsoft.Extensions.Validation (GHSA-m28h-pj36-4364)", in both the Tenable Cloud Security and Tenable Self Hosted Container Security catalogs. It sits in the SCA Checks family as a Local check (Revision 1.1, published 11/11/2026), flags installed packages affected by CVE-2026-118749, and treats 11.0.0 or later as fixed. Because it inspects package contents, it is a practical way to catch vulnerable runtimes inside container images and cloud workloads, including self-contained cases. Rapid7's vulnerability database also lists the CVE, but its public page does not describe a specific check method.

3. Behavioral monitoring

These signals follow from Microsoft's root cause description. No vendor-published rule exists for them.

• Prioritize the right endpoints. Minimal API endpoints that use built-in validation and accept collections in the request body deserve the closest watch.
• CPU that does not match traffic. Watch for worker CPU staying high, or thread pool pressure, after requests show as aborted or clients have disconnected. Ordinary load usually drops when connections close.
• Unusually large collection payloads. Look for requests to validated endpoints carrying oversized or densely populated arrays, especially ones likely to produce many validation errors, compared with baseline request sizes and element counts.
• Latency affecting everyone. Rising response times or health check failures across all users of an instance, combined with a small number of large inbound requests from a few sources.

Treat these as leads, not proof. Large batch payloads and normal CPU spikes can look the same, so confirm the instance's version falls within the affected range before attributing an event to CVE-2026-118749.

Affected systems and versions

• Affected package range (Microsoft advisory): 11.0.0-rc.1.26425.128 through 11.0.0-rc.3.26522.148, inclusive.
• First fixed version: 11.0.0 for all listed packages (SDK 11.0.100).
• Runtime packages: Microsoft.AspNetCore.App.Runtime.<RID> for linux-arm, linux-arm64, linux-musl-arm, linux-musl-arm64, linux-musl-x64, linux-x64, osx-arm64, osx-x64, win-arm64, win-x64 and win-x86.
• Standalone package: Microsoft.Extensions.Validation.
• Platforms: Windows, Linux and macOS, all architectures.
• Vulnerable configuration: Minimal API endpoints using the built-in validation that bind attacker-supplied collections.
• Not affected: Released versions outside the .NET 11 release candidate line, per the patch information.

The sources disagree on scope in two places. First, the CVE record describes a broader .NET 11 product range starting at 11.0.0-preview.1 and ending before 11.0.0, whereas the package advisory begins at the specific release candidate above. Use the package advisory for deployed version checks, and treat preview builds as superseded by 11.0.0 in any case. Second, the CVE record lists Visual Studio 2026 version 18.12 as affected at 18.12.0 without naming a fixed Visual Studio build, while the .NET 11.0.0 release notes state that SDK 11.0.100 is included with Visual Studio 18.12.0. We have not found a source that reconciles these two statements, so verify the SDK and runtime versions actually present rather than relying on the IDE version alone.

Vendor security history

Microsoft describes ASP.NET Core as a cross-platform, high-performance, open-source framework for web applications, APIs, real-time applications and RPC services. In the 2026 Stack Overflow Developer Survey, 2,045 of 10,281 respondents (19.9%) to the web technology question reported extensive ASP.NET Core work in the past year, a measure of developer use rather than of affected deployments. Data Center Dynamics, citing Synergy Research Group, reports a 20% Microsoft share of cloud infrastructure services in Q2 2026. That is company context and says nothing about Azure exposure to this CVE.

On track record, the Cyber Safety Review Board found the Summer 2023 Exchange Online intrusion preventable and, as summarized by DHS, identified decisions pointing to a culture that deprioritized enterprise security investment and rigorous risk management. Microsoft's July 2026 Secure Future Initiative report presents its own progress figures: more than 550,000 instances of critical and high-risk open-source vulnerabilities remediated, automated container patching addressing about 3 million vulnerability instances per month, and 1,989 CVEs published with CWE and CPE enrichment. Those are vendor-reported metrics. Neither the Exchange incident nor the SFI program has any technical relationship to this Minimal API validation flaw. For this CVE, what matters is whether deployed runtimes and validation packages are on 11.0.0.

References

• NVD: CVE-2026-118749
• CVE Record: CVE-2026-118749
• MSRC Update Guide entry (returned unavailable when accessed)
• dotnet/aspnetcore Security Advisory GHSA-m28h-pj36-4364
• GitHub Advisory Database: GHSA-m28h-pj36-4364
• GitHub Advisory API: GHSA-m28h-pj36-4364
• dotnet/announcements Issue #505
• dotnet/announcements Issue #505 (API)
• .NET 11.0.0 Release Notes
• .NET and .NET Framework November 2026 servicing updates
• Tenable Cloud Security Plugin 478934
• Tenable Container Security Plugin 478934
• OffSeq Threat Radar: Microsoft.AspNetCore.App.Runtime advisory record
• OffSeq Threat Radar: CVE-2026-118749 .NET 11.0 record
• Microsoft Learn: Validation in ASP.NET Core
• Microsoft Learn: Overview of ASP.NET Core
• CISA Known Exploited Vulnerabilities Catalog
• DHS: Cyber Safety Review Board report on the Summer 2023 Exchange Online incident
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• Microsoft SFI Progress Report, July 2026
• Stack Overflow Developer Survey 2026: Web frameworks and technologies
• DCD: Enterprise cloud infrastructure spending report