CVE-2026-96236: CWE-770: Allocation of Resources Without Limits or Throttling in Microsoft ASP.NET Core 10.0

The vulnerability identified as CVE-2026-96236 involves the allocation of resources without limits or throttling (CWE-770) in the Microsoft.AspNetCore.Localization component of ASP.NET Core. Specifically, the request-localization fallback mechanism can be exploited by unauthenticated requests to insert attacker-supplied synthetic culture names into the global cache, causing unbounded memory consumption and potential denial of service. This affects Microsoft .NET projects using affected package versions across multiple platforms and architectures. Microsoft has provided official fixes in updated package versions to remediate this issue.

Exploitation of this vulnerability can lead to denial of service due to unbounded memory growth caused by attacker-controlled input being cached globally. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered by unauthenticated remote attackers, increasing its risk.

An official fix is available from Microsoft. Users should update affected Microsoft.AspNetCore.App.Runtime packages to the patched versions (e.g., 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2, 17.14.42, 18.10.4) as soon as possible. Applying these updates will remove the vulnerability. No additional mitigation steps are indicated by the vendor advisory.