ASP.NET Core Unbounded Memory Growth in Localization Logic
Unauthenticated requests can exhaust memory via synthetic culture names in ASP.NET Core, leading to denial of service across multiple platforms.
Key points
- CVE-2026-96236 is rated high severity with a CVSS score of 7.5.
- The flaw affects ASP.NET Core versions 8 through 11 preview releases.
- Microsoft has released patched runtime versions for all affected platforms.
An attacker gains the ability to exhaust server memory and deny service to legitimate users by sending unauthenticated network requests. The vulnerability resides in ASP.NET Core localization logic, which accepts attacker-supplied synthetic culture names. These inputs trigger unbounded memory growth within the runtime's global cache, compromising availability.
How it unfolded
- Microsoft released a security advisory identifying CVE-2026-96236 in the Microsoft.AspNetCore.Localization component.
- The vendor determined that the localization fallback mechanism adds synthetic culture names to a global cache without limits.
- This behavior allows unauthenticated requests to cause unbounded memory growth, resulting in denial of service.
Who is affected
The vulnerability impacts Microsoft .NET projects using specific versions of Microsoft.AspNetCore.App.Runtime packages across Windows, Linux, and macOS. Affected versions include 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0 preview releases. All architectures are at risk, regardless of the underlying operating system or processor type.
The fix
Microsoft has provided patched versions for all affected platforms. Users of version 8 should update to 8.0.32. Version 9 users must move to 9.0.21. Those on version 10 should install 10.0.13. Developers using version 11 preview releases need to upgrade to 11.0.0-rc.2 to resolve the issue.
What made it possible
Teams usually encounter resource exhaustion when applications cache dynamic user input without size limits. In this scenario, the localization component treats every new culture string as a valid cache entry. Security teams should check whether middleware stores unique request parameters in global memory pools. Reviewing cache eviction policies helps prevent unbounded growth from synthetic inputs.
What to do and how to stay safe
- Audit ASP.NET Core applications for use of localization middleware and check current runtime versions against the advisory.
- Implement rate limiting on public endpoints to reduce the impact of resource-exhaustion attempts while patching.
- Monitor server memory usage for sudden, unexplained spikes that may indicate exploitation of the cache mechanism.
- Apply the vendor-provided runtime updates as soon as they become available in your deployment pipeline.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
