CVE-2026-70181: CWE-770: Allocation of Resources Without Limits or Throttling in Microsoft ASP.NET Core 10.0

The vulnerability identified as CVE-2026-70181 concerns the allocation of resources without limits or throttling (CWE-770) in the Microsoft.AspNetCore.WebUtilities component used in ASP.NET Core 10.0 and related runtime packages. Specifically, the FileBufferingReadStream eagerly rents buffers during multipart processing, which can cause excessive memory consumption leading to denial of service conditions. The issue affects multiple runtime packages across different platforms and architectures. Microsoft has issued official fixes for affected versions, with patched versions starting from 8.0.32, 9.0.21, 10.0.13, 17.14.42, and 18.10.4 onward. The CVSS v3.1 score is 7.5 (High), indicating a significant impact on availability without affecting confidentiality or integrity.

Successful exploitation of this vulnerability can result in denial of service due to memory exhaustion. There is no impact on confidentiality or integrity. The vulnerability affects availability of applications using the vulnerable Microsoft.AspNetCore.WebUtilities component during multipart processing.

An official fix is available from Microsoft. Users should update affected Microsoft.AspNetCore.App.Runtime packages to the patched versions: 8.0.32, 9.0.21, 10.0.13, 17.14.42, or 18.10.4 as applicable. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.