{"id":"CVE-2026-69304","sourceIdentifier":"secure@microsoft.com","published":"2026-09-08T18:18:46.347","lastModified":"2026-10-30T22:17:12.600","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":".NET 10.0 runtime","versions":[{"version":"10.0.0","lessThan":"10.0.12","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 8.0 runtime","versions":[{"version":"8.0.0","lessThan":"8.0.31","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 9.0 runtime","versions":[{"version":"9.0.0","lessThan":"9.0.20","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"ASP.NET Core 10.0","versions":[{"version":"10.0","lessThan":"10.0.12","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"ASP.NET Core 11.0","versions":[{"version":"11.0","lessThan":"11.0 RC1","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[{"version":"8.0","lessThan":"8.0.31","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"ASP.NET Core 9.0","versions":[{"version":"9.0","lessThan":"9.0.20","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.14","versions":[{"version":"17.14.0","lessThan":"17.14.40","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2026 version 18.9","versions":[{"version":"18.9.0","lessThan":"18.9.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-08T19:33:58.502592Z","id":"CVE-2026-69304","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-409"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.28","matchCriteriaId":"2E71C9A3-61A7-4494-B55A-6A420C236CA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.17","matchCriteriaId":"EA6B14D5-DA50-4679-A734-A427DA977254"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.9","matchCriteriaId":"7593F5CA-BDB0-46EC-A91F-082098558AD3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*","versionStartExcluding":"11.0.0","matchCriteriaId":"E0B2A071-EAAC-498D-A3E5-2D724D161D0C"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp.net_core:11.0:rc1:*:*:*:*:*:*","matchCriteriaId":"341D11BE-3403-4075-8CDD-C02F878D60A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.14.0","versionEndExcluding":"17.14.40","matchCriteriaId":"8FD99987-130F-47E5-B6FE-9C6701D7C3F5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*","versionStartIncluding":"18.9.0","versionEndExcluding":"18.9.3","matchCriteriaId":"C66064BF-3349-43FF-8A22-9370663193DE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.31","matchCriteriaId":"120A5F2F-CD6D-4EA6-ABBC-4AE8C397F722"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.20","matchCriteriaId":"40FA0BC2-46E4-425A-941B-B042FA960EDF"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.12","matchCriteriaId":"C3766C06-8F63-4266-AA40-E8DCC9A87F01"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69304","source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"]}]}