CVE-2026-96236: 
C# vulnerability analysis and mitigation

CVE-2026-96236 is a Denial of Service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling in the request-localization middleware (Microsoft.AspNetCore.Localization). Disclosed on October 13, 2026, as part of Microsoft's October 2026 Patch Tuesday, it affects ASP.NET Core 8.0 (< 8.0.32), 9.0 (< 9.0.21), 10.0 (< 10.0.13), and 11.0 (< 11.0.0-rc.2), as well as Microsoft Visual Studio 2022 (17.14.0–17.14.41) and Visual Studio 2026 (18.10.0–18.10.3). It carries a CVSS v3.1 base score of 7.5 (High) (MSRC Advisory, GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) within the ASP.NET Core request-localization fallback mechanism. Specifically, the Microsoft.AspNetCore.Localization middleware adds attacker-supplied synthetic culture names to the .NET runtime's global culture cache without any bounds or validation, allowing unbounded memory growth over time. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests containing arbitrary culture name values (e.g., via the Accept-Language header or query string culture parameters), requiring no privileges or user interaction. No public proof-of-concept code has been identified at this time (GitHub Advisory, MSRC Advisory).

Successful exploitation results in unbounded memory growth in the ASP.NET Core application process, ultimately causing the application to crash or become unresponsive, denying service to legitimate users. The impact is limited to availability — there is no confidentiality or integrity impact, and no lateral movement or data exfiltration risk is associated with this vulnerability. All platforms (Windows, Linux, macOS) and all architectures running affected ASP.NET Core versions are impacted, including self-contained application deployments (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is classified as automatable (no user interaction or privileges required), making it straightforward to exploit at scale once a method is developed. The EPSS score is 0.0, reflecting low current exploitation probability, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, MSRC Advisory).

1. Reconnaissance: Identify internet-facing ASP.NET Core applications running affected versions (8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, or 11.0.0-preview.1–11.0.0-rc.1) using tools like Shodan, Censys, or HTTP banner analysis.
2. Identify localization usage: Confirm the target application uses Microsoft.AspNetCore.Localization middleware by observing culture-related query parameters (e.g., ?culture=en-US) or Accept-Language header handling in responses.
3. Craft malicious requests: Send a high volume of HTTP requests with unique, attacker-controlled synthetic culture name values in the Accept-Language header or culture query string parameter (e.g., ?culture=attacker-synthetic-culture-XXXXXX), generating a large number of distinct invalid culture strings.
4. Exhaust server memory: Each unique synthetic culture name is added to the runtime's global culture cache without eviction, causing unbounded memory growth. Sustain the flood of requests to accelerate memory exhaustion.
5. Achieve denial of service: The application process runs out of memory and crashes or becomes unresponsive, denying service to legitimate users (GitHub Advisory).

• Network: High volume of HTTP requests containing unusual or randomized Accept-Language header values or culture query string parameters targeting ASP.NET Core endpoints; requests originating from a single IP or distributed sources with no legitimate browsing pattern.
• Logs: ASP.NET Core application logs showing repeated processing of unknown or malformed culture names; IIS/Kestrel access logs with high request rates to localization-enabled endpoints with varied culture parameters.
• Process/System: Rapid and sustained increase in the application process memory (w3wp.exe, dotnet.exe) without a corresponding increase in legitimate traffic; out-of-memory exceptions or application pool crashes in Windows Event Logs or systemd journal on Linux.
• Application: Unexpected application restarts or health check failures correlated with spikes in requests containing non-standard culture identifiers (GitHub Advisory).

Microsoft has released patched versions: ASP.NET Core 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2; Visual Studio 2022 17.14.42+; and Visual Studio 2026 18.10.4+. Developers should update NuGet package references to the patched Microsoft.AspNetCore.App.Runtime.* versions and restart applications; self-contained deployments must be recompiled and redeployed. As interim mitigations, implement network-level rate limiting, connection limits at the web server or load balancer, and request filtering to reject malformed or excessively varied Accept-Language / culture parameter values (MSRC Advisory, GitHub Advisory).

The vulnerability was noted in the Zero Day Initiative's October 2026 Patch Tuesday review and covered by BleepingComputer as part of Microsoft's broader October 2026 update cycle, which addressed over 1,400 flaws (ZDI Blog, BleepingComputer). Acknowledgements in the GitHub advisory credit researchers Kevin Schmidt, kayiz (Lien Phat Technology Corporation), Leandro Batista, Rolf Zengafinnen, and Revisions for responsible disclosure (GitHub Advisory).