CVE-2026-26130
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS
7.5
High
EPSS
2.8%
p85
KEV
—
Exploit Today
25
0-100
Published: Mar 10, 2026 · Last modified: Jul 15, 2026 · CWE-770
2.8%EPSS · 30 days2.8%
2026-06-302026-07-16
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10082
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10083
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10084
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10085
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10091
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4443
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4445
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4450
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4451
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4453
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4454
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4455
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4456
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:4458
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-26130
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2446134
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26130.json
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-217107.5 HIG97.8%
——29A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**2dCVE-2026-489337.5 HIG84.9%
——25A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.11hCVE-2026-455917.5 HIG82.4%
——25Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.2dCVE-2021-366307.5 HIG80.5%
——24DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via crafted request.8dCVE-2025-97847.5 HIG80.2%
——24A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).17dCVE-2025-617267.5 HIG77.9%
——23The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.11h