Listen to this Post
The vulnerability CVE-2026-69304 resides in the ASP.NET Core IIS out-of-process hosting module, specifically within the request decompression middleware. When ASP.NET Core applications are hosted behind IIS in the out-of-process model, the middleware responsible for handling and decompressing HTTP request bodies fails to properly constrain the decompression of certain content-encoded payloads, such as those using GZip or Deflate algorithms. The core of the issue is a classic data amplification weakness, categorized under CWE-409. An unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing a small, highly compressed payload that, when decompressed by the middleware, expands to an enormous size. This uncontrolled memory expansion causes the server to allocate excessive memory to process the inflated request. As the middleware attempts to decompress the data for the application to read, it rapidly consumes all available memory on the IIS worker process, leading to out-of-memory conditions. This subsequently triggers application crashes, process recycling, and a full Denial of Service (DoS) for the hosted application. The attack does not require authentication and can be performed over the network, making it remotely exploitable. However, the attack complexity is high as it requires crafting a specific data stream that maximizes the decompression ratio within the constraints of the compression algorithm. The vulnerability affects all .NET versions from .NET 8 through .NET 11 Release Candidate 1, specifically when used with the IIS out-of-process hosting model. Microsoft has released updates to the .NET SDK and runtime that correct this behavior by introducing strict limits on the decompressed data size before processing. The recommended mitigation is to update to the latest patched .NET versions and restart the application. For self-contained deployments, recompilation and redeployment are mandatory for the fix to be applied. This issue has been disclosed by security researchers, contributing to the coordinated release of the advisory and patches, which is detailed in the dotnet/announcements repository.
DailyCVE Form:
Platform: IIS out-of-process
Version: .NET 8-11
Vulnerability: Data amplification
Severity: Medium
date: 09/08/2026
Prediction: Already patched
What Undercode Say:
List installed SDKs and runtimes dotnet --info Update to patched version (e.g., .NET 8.0.x) Download and install from https://dotnet.microsoft.com/download
Exploit: (Educational Purposes!)
An attacker would generate a compressed payload (e.g., a 42.zip style bomb) using standard compression tools, embed it within a POST request body with the appropriate `Content-Encoding: gzip` header, and direct the request to the vulnerable IIS endpoint. The server would then attempt to expand the request to its full size, exhausting memory.
Protection:
- Update .NET Runtime and SDK to the latest patched versions.
- Restart all applications and IIS services after update.
3. Recompile and redeploy self-contained applications.
Impact:
Complete Denial of Service, causing the application to become unresponsive and crash due to memory exhaustion, requiring manual service restarts.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
