{"history":[{"alert":0,"cve":"CVE-2026-114154","id":23077,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.013, \"percentile\": 0.7085}"},{"alert":1,"cve":"CVE-2026-114154","id":21356,"kind":"cna","observed_at":1794500401,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-114154\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-10T20:03:14.001023Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T20:09:28.512Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \".NET 10.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.15\", \"status\": \"affected\", \"version\": \"10.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 8.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"8.0.34\", \"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 9.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"9.0.23\", \"status\": \"affected\", \"version\": \"9.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2022 version 17.14\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"17.14.45\", \"status\": \"affected\", \"version\": \"17.14.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2026 version 18.11\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"18.11.4\", \"status\": \"affected\", \"version\": \"18.11.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2026 version 18.12\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"18.12.0\", \"status\": \"affected\", \"version\": \"18.12.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft.AspNetCore.Server.HttpSys\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"2.3.14\", \"status\": \"affected\", \"version\": \"2.3.10\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:microsoft.aspnetcore.server.httpsys:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.14\", \"versionStartIncluding\": \"2.3.10\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"8.0.34\", \"versionStartIncluding\": \"8.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.0.23\", \"versionStartIncluding\": \"9.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.0.15\", \"versionStartIncluding\": \"10.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"17.14.45\", \"versionStartIncluding\": \"17.14.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.11.4\", \"versionStartIncluding\": \"18.11.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.12.0\", \"versionStartIncluding\": \"18.12.0\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"datePublic\": \"2026-11-10T16:00:00.000Z\", \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-401\", \"description\": \"CWE-401: Missing Release of Memory after Effective Lifetime\", \"lang\": \"en-US\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-12T15:44:23.946Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"name\": \"ASP.NET Core Denial of Service Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154\"}], \"title\": \"ASP.NET Core Denial of Service Vulnerability\"}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2026-114154\", \"datePublished\": \"2026-11-10T18:19:15.771Z\", \"dateReserved\": \"2026-10-20T21:56:39.317Z\", \"dateUpdated\": \"2026-11-12T15:44:23.946Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-114154","id":21094,"kind":"cna","observed_at":1794392402,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-114154\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-10T20:03:14.001023Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T20:09:28.512Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \".NET 10.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.15\", \"status\": \"affected\", \"version\": \"10.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 8.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"8.0.34\", \"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 9.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"9.0.23\", \"status\": \"affected\", \"version\": \"9.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2022 version 17.14\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"17.14.45\", \"status\": \"affected\", \"version\": \"17.14.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2026 version 18.11\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"18.11.4\", \"status\": \"affected\", \"version\": \"18.11.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2026 version 18.12\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"18.12.0\", \"status\": \"affected\", \"version\": \"18.12.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft.AspNetCore.Server.HttpSys\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"2.3.14\", \"status\": \"affected\", \"version\": \"2.3.10\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:microsoft.aspnetcore.server.httpsys:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.3.14\", \"versionStartIncluding\": \"2.3.10\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"8.0.34\", \"versionStartIncluding\": \"8.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.0.23\", \"versionStartIncluding\": \"9.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.0.15\", \"versionStartIncluding\": \"10.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"17.14.45\", \"versionStartIncluding\": \"17.14.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.11.4\", \"versionStartIncluding\": \"18.11.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.12.0\", \"versionStartIncluding\": \"18.12.0\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"datePublic\": \"2026-11-10T16:00:00.000Z\", \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-401\", \"description\": \"CWE-401: Missing Release of Memory after Effective Lifetime\", \"lang\": \"en-US\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T23:50:49.252Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"name\": \"ASP.NET Core Denial of Service Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154\"}], \"title\": \"ASP.NET Core Denial of Service Vulnerability\"}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2026-114154\", \"datePublished\": \"2026-11-10T18:19:15.771Z\", \"dateReserved\": \"2026-10-20T21:56:39.317Z\", \"dateUpdated\": \"2026-11-10T23:50:49.252Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]},{"product":"Microsoft.AspNetCore.Server.HttpSys","vendor":"Microsoft","versions":[{"lessThan":"2.3.14","status":"affected","version":"2.3.10","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-114154","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:03:14.001023Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-10T20:09:28.512Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2022 version 17.14","vendor":"Microsoft","versions":[{"lessThan":"17.14.45","status":"affected","version":"17.14.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.11","vendor":"Microsoft","versions":[{"lessThan":"18.11.4","status":"affected","version":"18.11.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]},{"product":"Microsoft.AspNetCore.Server.HttpSys","vendor":"Microsoft","versions":[{"lessThan":"2.3.14","status":"affected","version":"2.3.10","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:microsoft.aspnetcore.server.httpsys:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.14","versionStartIncluding":"2.3.10","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.15","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionEndExcluding":"17.14.45","versionStartIncluding":"17.14.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*","versionEndExcluding":"18.11.4","versionStartIncluding":"18.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*","versionEndExcluding":"18.12.0","versionStartIncluding":"18.12.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-401","description":"CWE-401: Missing Release of Memory after Effective Lifetime","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T15:44:23.946Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"ASP.NET Core Denial of Service Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154"}],"title":"ASP.NET Core Denial of Service Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-114154","datePublished":"2026-11-10T18:19:15.771Z","dateReserved":"2026-10-20T21:56:39.317Z","dateUpdated":"2026-11-12T15:44:23.946Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-114154","description":"Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.","epss":{"date":"2026-11-12","epss":0.013,"percentile":0.7085},"epss_checked":1794522003,"first_seen":1794376805,"kev":null,"kev_checked":1794522003,"products":"Microsoft .NET 10.0 installed on Windows, Microsoft .NET 8.0 installed on Windows, Microsoft .NET 9.0 installed on Windows, Microsoft Microsoft Visual Studio 2022 version 17.14, Microsoft Microsoft Visual Studio 2026 version 18.11, Microsoft Microsoft Visual Studio 2026 version 18.12, Microsoft Microsoft.AspNetCore.Server.HttpSys","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154"],"score":{"baseScore":7.5,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"ASP.NET Core Denial of Service Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://github.com/advisories/GHSA-3893-7fxc-qvff","id":341,"publisher":"GitHub Advisory Database","title":"Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability"},{"canonical_url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/","id":375,"publisher":"BleepingComputer","title":"Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day"}]}