{"uuid": "e38aa50f-1b4c-4d4f-b83e-d691a8a7e805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69304", "type": "seen", "source": "https://gist.github.com/alon710/46a2cca30f1d02f7c73e3ad748076138", "content": "# CVE-2026-69304: CVE-2026-69304: Denial of Service via Request Decompression Data Amplification in ASP.NET Core\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69304\n\n## Summary\nAn Improper Handling of Highly Compressed Data (Data Amplification) vulnerability (CVE-2026-69304) exists in Microsoft ASP.NET Core and Microsoft .NET. It allows unauthenticated remote attackers to trigger resource exhaustion and denial of service via highly compressed request payloads.\n\n## TL;DR\nA Medium severity (CVSS 5.9) denial-of-service vulnerability in ASP.NET Core allows unauthenticated attackers to cause memory exhaustion and crash the server via compressed HTTP request payloads.\n\n## Technical Details\n\n- **CWE ID**: CWE-409\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00768\n- **Impact**: Availability (High)\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft .NET 10.0\n- Microsoft .NET 9.0\n- Microsoft .NET 8.0\n- ASP.NET Core 11.0\n- ASP.NET Core 10.0\n- ASP.NET Core 9.0\n- ASP.NET Core 8.0\n- Visual Studio 2022 (v17.14)\n- Visual Studio 2026 (v18.9)\n- **.NET 10.0**: 10.0.0 to < 10.0.12 (Fixed in: `10.0.12`)\n- **.NET 9.0**: 9.0.0 to < 9.0.20 (Fixed in: `9.0.20`)\n- **.NET 8.0**: 8.0.0 to < 8.0.31 (Fixed in: `8.0.31`)\n- **ASP.NET Core 11.0**: 11.0 to < 11.0 RC1 (Fixed in: `11.0 RC1`)\n- **ASP.NET Core 10.0**: 10.0.0 to < 10.0.12 (Fixed in: `10.0.12`)\n- **ASP.NET Core 9.0**: 9.0.0 to < 9.0.20 (Fixed in: `9.0.20`)\n- **ASP.NET Core 8.0**: 8.0.0 to < 8.0.31 (Fixed in: `8.0.31`)\n- **Visual Studio 2022 (v17.14)**: 17.14.0 to < 17.14.40 (Fixed in: `17.14.40`)\n- **Visual Studio 2026 (v18.9)**: 18.9.0 to < 18.9.3 (Fixed in: `18.9.3`)\n\n## Mitigation\n\n- Upgrade the host .NET Runtime and SDK to version 10.0.12, 9.0.20, or 8.0.31 respectively.\n- Disable request decompression middleware (app.UseRequestDecompression()) globally if not actively required.\n- Enforce explicit request body limits (MaxRequestBodySize) inside Kestrel configuration.\n- Configure WAF rules or reverse proxies to reject or strip compressed headers (Content-Encoding) on unauthenticated routes.\n\n**Remediation Steps:**\n1. Identify all ASP.NET Core deployment environments utilizing request decompression middleware.\n2. Apply Microsoft .NET framework cumulative updates to target servers.\n3. In corporate SDK repositories, update global project configurations to target .NET SDK 10.0.12+, 9.0.20+, or 8.0.31+.\n4. Where instant patching is unavailable, edit the Program.cs or Startup.cs configuration files to remove the 'app.UseRequestDecompression()' middleware directive.\n5. Add Kestrel server option limits for request body sizes inside the hosting startup sequence.\n\n## References\n\n- [Microsoft Security Advisory Guide (CVE-2026-69304)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69304)\n- [CVE Record Entry on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-69304)\n- [NVD Entry Details for CVE-2026-69304](https://nvd.nist.gov/vuln/detail/CVE-2026-69304)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69304) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T17:32:30.125625Z"}