CVE-2026-69304Medium· 5.9▾ SunlitImproper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.8%
0.8% → 0.9%
Last analysed / modified upstream
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
asp.net_core >= 8.0.0, < 8.0.28asp.net_core >= 9.0.0, < 9.0.17asp.net_core >= 10.0.0, < 10.0.9asp.net_core > 11.0.0asp.net_core = 11.0visual_studio_2022 >= 17.14.0, < 17.14.40visual_studio_2026 >= 18.9.0, < 18.9.3.net >= 8.0.0, < 8.0.31.net >= 9.0.0, < 9.0.20.net >= 10.0.0, < 10.0.12Upgrade past the affected range:
asp.net_core 10.0.9visual_studio_2022 17.14.40visual_studio_2026 18.9.3.net 10.0.12Affected packages:
Microsoft.AspNetCore.Server.IISIntegration >= 11.0.0-preview.1, < 11.0.0-rc.1Microsoft.AspNetCore.Server.IISIntegration >= 8.0.0, <= 8.0.30Microsoft.AspNetCore.Server.IISIntegration >= 9.0.0, <= 9.0.19Microsoft.AspNetCore.Server.IISIntegration >= 10.0.0, <= 10.0.11Patched in:
Microsoft.AspNetCore.Server.IISIntegration 11.0.0-rc.1Microsoft.AspNetCore.Server.IISIntegration 8.0.31Microsoft.AspNetCore.Server.IISIntegration 9.0.20Microsoft.AspNetCore.Server.IISIntegration 10.0.12Source: https://github.com/advisories/GHSA-8cp2-47hg-mfgh
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97801High· 7.5Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
CVE-2026-116175Medium· 6.5vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
CVE-2026-116177High· 7.5vllm: vllm: Denial of Service via unconstrained image decompression (CVE-2026-116177)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2026-112892High· 7.5pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)
CVE-2026-78384High· 7.5CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap