VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Sep 8, 2026· Updated Sep 30, 2026

CVE-2026-69304

CVE-2026-69304

Description

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.AspNetCore.Server.IISIntegrationNuGet
>= 11.0.0-preview.1, < 11.0.0-rc.111.0.0-rc.1
Microsoft.AspNetCore.Server.IISIntegrationNuGet
>= 8.0.0, < 8.0.318.0.31
Microsoft.AspNetCore.Server.IISIntegrationNuGet
>= 9.0.0, < 9.0.209.0.20
Microsoft.AspNetCore.Server.IISIntegrationNuGet
>= 10.0.0, < 10.0.1210.0.12

Affected products

9
  • Microsoft/Net
    cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
    Range: >=8.0.0,<8.0.31
  • Microsoft/Aspnetcore3 versions
    cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*range: >=8.0.0,<8.0.28
    • cpe:2.3:a:microsoft:asp.net_core:11.0:rc1:*:*:*:*:*:*
    • (no CPE)
  • Microsoft/Visual Studio2 versions
    cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*range: >=17.14.0,<17.14.40
    • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*range: >=18.9.0,<18.9.3
  • osv-coords3 versions
    pkg:bitnami/aspnet-corepkg:bitnami/dotnetpkg:bitnami/dotnet-sdk
    >= 8.0.0, < 8.0.28+ 2 more
    • (no CPE)range: >= 8.0.0, < 8.0.28
    • (no CPE)range: >= 8.0.0, < 8.0.31
    • (no CPE)range: >= 8.0.0, < 8.0.31

Patches

Vulnerability mechanics

References

4

News mentions

2