CVE-2026-118750

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. FileBufferingReadStream buffer allocation can allow unauthenticated multipart-form requests to exhaust memory. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/512 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-770 ## Affected Platforms - **Platforms:** Any supported OS - **Architectures:** All ## <a name="affected-packages"></a>Affected Packages The table lists the affected package range and the fixed NuGet version. ### ASP.NET Core 2.3 - standalone packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.WebUtilities](https://www.nuget.org/packages/Microsoft.AspNetCore.WebUtilities) | >= 2.3.0, <= 2.3.13 | 2.3.14 ## Advisory FAQ ### <a name="how-affected"></a>How do I know if I am affected? Check the application's Microsoft.AspNetCore.WebUtilities package reference against the affected range above, including transitive dependencies brought in by Microsoft.AspNetCore.Http. Use `dotnet list <PROJECT> package --include-transitive` to inspect resolved dependencies. ### <a name="how-fix"></a>How do I fix the issue? Update each applicable package reference to its patched version listed above, then rebuild and redeploy the application. Updating only the installed runtime does not update an application's standalone package references. Applications referencing Microsoft.AspNetCore.Http must resolve Microsoft.AspNetCore.WebUtilities to version 2.3.14 or later. Add or update a direct WebUtilities reference if necessary to override an older transitive dependency. ## Other Information ### Reporting Security Issues If you have