Microsoft Asp.net_core
39 CVEs affecting Microsoft Asp.net_core. Latest disclosed: 2026-06-09. Critical: 2, High: 30.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55315 | Critical | 9.9 | 2025-10-14 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature ove… |
CVE-2026-40372 | Critical | 9.1 | 2026-04-21 | Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
CVE-2021-43877 | High | 8.8 | 2021-12-15 | ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability |
CVE-2020-0603 | High | 8.8 | 2020-01-14 | A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploite… |
CVE-2019-1302 | High | 8.8 | 2019-09-11 | An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web… |
CVE-2018-0787 | High | 8.8 | 2018-03-14 | ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests… |
CVE-2018-0784 | High | 8.8 | 2018-01-10 | ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privileg… |
CVE-2017-11879 | High | 8.8 | 2017-11-15 | ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core… |
CVE-2023-36038 | High | 8.2 | 2023-11-14 | ASP.NET Core Denial of Service Vulnerability |
CVE-2026-45591 | High | 7.5 | 2026-06-09 | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-26130 | High | 7.5 | 2026-03-10 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2025-26682 | High | 7.5 | 2025-04-08 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2024-21404 | High | 7.5 | 2024-02-13 | .NET Denial of Service Vulnerability |
CVE-2024-21386 | High | 7.5 | 2024-02-13 | .NET Denial of Service Vulnerability |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-38180 | High | 7.5 | 2023-08-08 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2021-1723 | High | 7.5 | 2021-01-12 | ASP.NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2020-1045 | High | 7.5 | 2020-09-11 | <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes… |
CVE-2020-1597 | High | 7.5 | 2020-08-17 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cau… |
CVE-2020-1161 | High | 7.5 | 2020-05-21 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. |