CVE-2026-69304
CVE-2026-69304 is a medium-severity vulnerability in Microsoft Asp.net Core with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-409.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- EPSS exploit prediction: 1% (58th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-409
- Affected product: Microsoft Asp.net Core
- Published:
- Last modified:
Description
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Frequently asked questions
- What is CVE-2026-69304?
- Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- How severe is CVE-2026-69304?
- CVE-2026-69304 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-69304 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-69304?
- CVE-2026-69304 primarily affects Microsoft Asp.net Core. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-69304?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-69304 published?
- CVE-2026-69304 was published on 2026-09-08 and last updated on 2026-09-30.
References
Affected products (5)
- cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:asp.net_core:11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
More vulnerabilities in Microsoft Asp.net Core
- CVE-2025-55315 — Critical (CVSS 9.9): Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized…
- CVE-2026-40372 — Critical (CVSS 9.1): Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges…
- CVE-2021-43877 — High (CVSS 8.8): ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
- CVE-2020-0603 — High (CVSS 8.8): A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in…
- CVE-2019-1302 — High (CVSS 8.8): An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project…
- CVE-2018-0787 — High (CVSS 8.8): ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are…
All CVEs affecting Microsoft Asp.net Core →
Other CWE-409 vulnerabilities
- CVE-2026-68911 — High (CVSS 8.7): Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote…
- CVE-2026-77620 — High (CVSS 8.7): Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each…
- CVE-2026-62963 — High (CVSS 8.7): Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket…
- CVE-2026-55195 — High (CVSS 8.7): py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and…
- CVE-2026-53430 — High (CVSS 8.7): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc…
- CVE-2026-44697 — High (CVSS 8.6): Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated…