What is CVE-2026-69304?

CVE-2026-69304 is a medium-severity vulnerability in Microsoft Asp.net Core 10.0, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 5.9/10. Published 2026-09-08.

How severe is CVE-2026-69304?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Microsoft Asp.net Core 10.0

CVE-2026-69304

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Microsoft Asp.net Core 10.0
Microsoft Asp.net Core 11.0
Microsoft Asp.net Core 8.0
Microsoft Asp.net Core 9.0
Microsoft Visual Studio 2022 Version 17.14
Microsoft Visual Studio 2026 Version 18.9
Microsoft .Net 10.0
Microsoft .Net 8.0
Microsoft .Net 9.0

Weakness classification (CWE)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)

References

secure@microsoft.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-69304?: CVE-2026-69304 is a medium-severity vulnerability in Microsoft Asp.net Core 10.0, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 5.9/10. Published 2026-09-08.
How severe is CVE-2026-69304?: Medium severity. CVSS v3 base score is 5.9 out of 10.