CVE-2026-109468

{
  "etk_id": "ETK-2026-1731",
  "cve_id": "CVE-2026-109468",
  "display_id": "CVE-2026-109468",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-102468",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uncontrolled resource allocation in ASP.NET Core",
  "summary": "Affected ASP.NET Core software can consume excessive resources when reached over the network. An unauthenticated attacker may make the service unavailable if they can send requests to an affected deployment.",
  "mitigation": "Update Visual Studio 2022 to 17.14.42, Visual Studio 2026 to 18.10.4, and System.Formats.Cbor to 10.0.13, as applicable. Restrict network access to affected services until updates are deployed.",
  "vendor": "Microsoft",
  "product": "Microsoft Visual Studio 2022 version 17.14",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 17.14.0, < 17.14.42"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "17.14.42"
      ],
      "package_name": "Microsoft Visual Studio 2022 version 17.14",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 18.10.0, < 18.10.4"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "18.10.4"
      ],
      "package_name": "Microsoft Visual Studio 2026 version 18.10",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 10.0.0, < 10.0.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "10.0.13"
      ],
      "package_name": "System.Formats.Cbor",
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
  "epss_score": 0.0065,
  "epss_percentile": 0.5002,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 22.439954733333334,
  "t0_at": "2026-10-15T20:57:33.441000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T23:40:59.502853+00:00",
      "days": 0.11349608626157408,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T20:57:33.441000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T20:57:33.441000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T20:57:33.441000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109468"
    }
  }
}