CVE-2026-69304

Published: Sep 8, 2026Modified: Sep 30, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected (10)

Products: Microsoft: Asp.net Core, Visual Studio 2022, Visual Studio 2026, .net

4 products

Visual Studio 2022

Visual Studio 2026

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Asp.net Core	version > 11.0.0
Microsoft Asp.net Core	10.0.0 ≤ version < 10.0.9
Microsoft Asp.net Core	8.0.0 ≤ version < 8.0.28
Microsoft Asp.net Core	9.0.0 ≤ version < 9.0.17
Microsoft Asp.net Core	Version 11.0 rc1
Microsoft Visual Studio 2022	17.14.0 ≤ version < 17.14.40
Microsoft Visual Studio 2026	18.9.0 ≤ version < 18.9.3

Configuration B

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft .net	10.0.0 ≤ version < 10.0.12
Microsoft .net	8.0.0 ≤ version < 8.0.31
Microsoft .net	9.0.0 ≤ version < 9.0.20

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Improper Handling of Highly Compressed Data (Data Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69304

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.