Key points
- The flaw allows unauthenticated attackers to cause unbounded memory growth via synthetic culture names.
- Patched versions are available for ASP.NET Core 8, 9, 10, and 11 across Windows, Linux, and macOS.
- The vulnerability is rated high severity with a CVSS score of 7.5 and requires no user interaction.
Attackers can exploit a flaw in ASP.NET Core to deny service by triggering unbounded memory growth. The vulnerability, identified as CVE-2026-96236, resides in the localization logic of Microsoft's web framework. According to the Microsoft Security Update Guide, the issue stems from the allocation of resources without limits or throttling. An unauthorized attacker can send network requests that add synthetic culture names to the runtime's global cache. This behavior consumes memory indefinitely, leading to a denial of service for the affected application.
Microsoft has released patches for affected versions of ASP.NET Core. The advisory covers versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1. Developers must update to specific patched versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2. The fix applies to all supported platforms, including Windows, Linux, and macOS, across all architectures.
What we know
The GitHub advisory GHSA-f4g7-52wc-p8x7 rates the severity as high with a CVSS score of 7.5. The vector indicates that the attack is network-accessible and requires low complexity. It does not require any privileges or user interaction. The weakness is classified as CWE-770, which denotes the allocation of resources without limits or throttling. The flaw specifically affects the Microsoft.AspNetCore.Localization component. Request-localization fallback mechanisms previously allowed attacker-supplied synthetic culture names to persist in the global cache. This accumulation leads to memory exhaustion.
Defender's checklist
- Verify current ASP.NET Core runtime versions in all production and staging environments.
- Identify applications using Microsoft.AspNetCore.Localization that have not been updated recently.
- Monitor system memory usage for sudden, unexplained increases in web server processes.
- Review network logs for unusual patterns of localization-related HTTP requests.
What analysts watch for
Security teams usually monitor for rapid memory consumption in web server processes. Analysts check whether applications are receiving unexpected localization headers or culture parameters. They examine logs for repeated requests with synthetic or malformed culture names. Teams often look for patterns indicating automated scanning or fuzzing attempts. Persistence is not a factor here, but spread occurs via network requests. Examine resource allocation metrics to detect throttling failures. Watch for service degradation correlated with specific endpoint access.
What to do and how to stay safe: Microsoft
- Update all ASP.NET Core applications to the patched versions listed in the advisory.
- Monitor application memory usage for signs of unbounded growth after updates.
- Restrict access to localization endpoints if possible using network segmentation.
- Review application logs for evidence of exploitation attempts using synthetic cultures.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ASP.NET Core versions are vulnerable to CVE-2026-96236?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1 are affected.
What is the severity of this vulnerability?
The vulnerability is rated high severity with a CVSS score of 7.5.
Is there a patch available for this issue?
Yes, Microsoft has released patches for all affected versions, including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
