{"schema_version":"2","view":"grouped","data":[{"id":61633,"cve_ids":["CVE-2026-69304"],"payload":{"kind":"advisory","title":"ASP.NET Core Denial of Service Vulnerability","summary":"Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.","evidence":"cve:CVE-2026-69304","products":[{"name":{"value":".NET 10.0","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":".NET 8.0","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":".NET 9.0","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 10.0","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 11.0","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 8.0","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 9.0","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Microsoft Visual Studio 2022 version 17.14","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Microsoft Visual Studio 2026 version 18.9","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-69304","aliases":["CVE-2026-69304"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"affected":[{"vendor":"Microsoft","product":".NET 10.0","versions":[{"status":"affected","version":"10.0.0","lessThan":"10.0.12","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0","versions":[{"status":"affected","version":"8.0.0","lessThan":"8.0.31","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0","versions":[{"status":"affected","version":"9.0.0","lessThan":"9.0.20","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 10.0","versions":[{"status":"affected","version":"10.0","lessThan":"10.0.12","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 11.0","versions":[{"status":"affected","version":"11.0","lessThan":"11.0 RC1","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"status":"affected","version":"8.0","lessThan":"8.0.31","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 9.0","versions":[{"status":"affected","version":"9.0","lessThan":"9.0.20","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.14","versions":[{"status":"affected","version":"17.14.0","lessThan":"17.14.40","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2026 version 18.9","versions":[{"status":"affected","version":"18.9.0","lessThan":"18.9.3","versionType":"custom"}]}],"modified":"2026-10-14T23:13:13.568Z","provider":"cve","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69304"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-69304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T19:33:58.502592Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T19:34:17.319Z"}}],"cna":{"orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft","dateUpdated":"2026-10-14T23:13:13.568Z"}}},"related_cves":[{"value":"CVE-2026-69304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8edf7611-3d3c-426b-969e-8bb949c49632","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"aspnet-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.28","evidence":"/affected/0/ranges"},{"value":"9.0.17","evidence":"/affected/0/ranges"},{"value":"10.0.9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-aspnet-core-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"dotnet","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.31","evidence":"/affected/0/ranges"},{"value":"9.0.20","evidence":"/affected/0/ranges"},{"value":"10.0.12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-dotnet-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"dotnet-sdk","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.31","evidence":"/affected/0/ranges"},{"value":"9.0.20","evidence":"/affected/0/ranges"},{"value":"10.0.12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":4,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-69304","advisory_id":"8edf7611-3d3c-426b-969e-8bb949c49632","event_types":["advisory"],"published_at":"2026-10-25T18:52:59.887768+00:00","technologies":["asp-net-core-10-0","asp-net-core-11-0","asp-net-core-8-0","asp-net-core-9-0","core-cve","microsoft-visual-studio-2022-version-17-14","microsoft-visual-studio-2026-version-18-9","net-10-0","net-8-0","net-9-0"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-08T17:17:47.686+00:00","detail_url":"/advisories/advisory%3A8edf7611-3d3c-426b-969e-8bb949c49632","group":{"id":"advisory:8edf7611-3d3c-426b-969e-8bb949c49632","revision":1,"primary_event_id":60881,"change":"published","superseded_by":[],"changed":{"id":60881,"cve_ids":["CVE-2026-69304"],"payload":{"kind":"advisory","title":"ASP.NET Core Denial of Service Vulnerability","summary":"Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.","evidence":"cve:CVE-2026-69304","products":[{"name":{"value":".NET 10.0","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":".NET 8.0","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":".NET 9.0","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 10.0","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 11.0","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 8.0","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 9.0","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Microsoft Visual Studio 2022 version 17.14","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Microsoft Visual Studio 2026 version 18.9","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-69304","aliases":["CVE-2026-69304"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"affected":[{"vendor":"Microsoft","product":".NET 10.0","versions":[{"status":"affected","version":"10.0.0","lessThan":"10.0.12","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0","versions":[{"status":"affected","version":"8.0.0","lessThan":"8.0.31","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0","versions":[{"status":"affected","version":"9.0.0","lessThan":"9.0.20","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 10.0","versions":[{"status":"affected","version":"10.0","lessThan":"10.0.12","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 11.0","versions":[{"status":"affected","version":"11.0","lessThan":"11.0 RC1","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"status":"affected","version":"8.0","lessThan":"8.0.31","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 9.0","versions":[{"status":"affected","version":"9.0","lessThan":"9.0.20","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.14","versions":[{"status":"affected","version":"17.14.0","lessThan":"17.14.40","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2026 version 18.9","versions":[{"status":"affected","version":"18.9.0","lessThan":"18.9.3","versionType":"custom"}]}],"modified":"2026-10-14T23:13:13.568Z","provider":"cve","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69304"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-69304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T19:33:58.502592Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T19:34:17.319Z"}}],"cna":{"orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft","dateUpdated":"2026-10-14T23:13:13.568Z"}}},"related_cves":[{"value":"CVE-2026-69304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8edf7611-3d3c-426b-969e-8bb949c49632","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"aspnet-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.28","evidence":"/affected/0/ranges"},{"value":"9.0.17","evidence":"/affected/0/ranges"},{"value":"10.0.9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-aspnet-core-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"dotnet","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.31","evidence":"/affected/0/ranges"},{"value":"9.0.20","evidence":"/affected/0/ranges"},{"value":"10.0.12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-dotnet-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"dotnet-sdk","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.31","evidence":"/affected/0/ranges"},{"value":"9.0.20","evidence":"/affected/0/ranges"},{"value":"10.0.12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":4,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-69304","advisory_id":"8edf7611-3d3c-426b-969e-8bb949c49632","event_types":["advisory"],"published_at":"2026-10-25T18:52:59.887768+00:00","technologies":["asp-net-core-10-0","asp-net-core-11-0","asp-net-core-8-0","asp-net-core-9-0","core-cve","microsoft-visual-studio-2022-version-17-14","microsoft-visual-studio-2026-version-18-9","net-10-0","net-8-0","net-9-0"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-08T17:17:47.686+00:00","detail_url":"/events/60881"},"members":[{"id":60881,"cve_ids":["CVE-2026-69304"],"payload":{"kind":"advisory","title":"ASP.NET Core Denial of Service Vulnerability","summary":"Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.","evidence":"cve:CVE-2026-69304","products":[{"name":{"value":".NET 10.0","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":".NET 8.0","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":".NET 9.0","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 10.0","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 11.0","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 8.0","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ASP.NET Core 9.0","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Microsoft Visual Studio 2022 version 17.14","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Microsoft Visual Studio 2026 version 18.9","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-69304","aliases":["CVE-2026-69304"],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"affected":[{"vendor":"Microsoft","product":".NET 10.0","versions":[{"status":"affected","version":"10.0.0","lessThan":"10.0.12","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0","versions":[{"status":"affected","version":"8.0.0","lessThan":"8.0.31","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0","versions":[{"status":"affected","version":"9.0.0","lessThan":"9.0.20","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 10.0","versions":[{"status":"affected","version":"10.0","lessThan":"10.0.12","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 11.0","versions":[{"status":"affected","version":"11.0","lessThan":"11.0 RC1","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"status":"affected","version":"8.0","lessThan":"8.0.31","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core 9.0","versions":[{"status":"affected","version":"9.0","lessThan":"9.0.20","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.14","versions":[{"status":"affected","version":"17.14.0","lessThan":"17.14.40","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2026 version 18.9","versions":[{"status":"affected","version":"18.9.0","lessThan":"18.9.3","versionType":"custom"}]}],"modified":"2026-10-14T23:13:13.568Z","provider":"cve","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69304"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-69304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-08T19:33:58.502592Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-08T19:34:17.319Z"}}],"cna":{"orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft","dateUpdated":"2026-10-14T23:13:13.568Z"}}},"related_cves":[{"value":"CVE-2026-69304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8edf7611-3d3c-426b-969e-8bb949c49632","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"aspnet-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.28","evidence":"/affected/0/ranges"},{"value":"9.0.17","evidence":"/affected/0/ranges"},{"value":"10.0.9","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-aspnet-core-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"dotnet","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.31","evidence":"/affected/0/ranges"},{"value":"9.0.20","evidence":"/affected/0/ranges"},{"value":"10.0.12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-dotnet-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-69304","metrics":[],"products":[{"name":{"value":"dotnet-sdk","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.31","evidence":"/affected/0/ranges"},{"value":"9.0.20","evidence":"/affected/0/ranges"},{"value":"10.0.12","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-69304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":4,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-69304","advisory_id":"8edf7611-3d3c-426b-969e-8bb949c49632","event_types":["advisory"],"published_at":"2026-10-25T18:52:59.887768+00:00","technologies":["asp-net-core-10-0","asp-net-core-11-0","asp-net-core-8-0","asp-net-core-9-0","core-cve","microsoft-visual-studio-2022-version-17-14","microsoft-visual-studio-2026-version-18-9","net-10-0","net-8-0","net-9-0"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-08T17:17:47.686+00:00","detail_url":"/events/60881"}]}}],"next_after":61633,"next_before":61633}