CVE-2026-118748: Unbounded Memory Allocation Denial of Service in ASP.NET Core Blazor Static-SSR

CVE-2026-118748 is a resource exhaustion vulnerability affecting Microsoft ASP.NET Core in .NET 11.0 preview builds (versions < 11.0.0 starting from 11.0.0-preview.1) across Linux, macOS, and Windows platforms, as well as Microsoft Visual Studio 2026 (< 18.12.0). The defect resides within the Blazor static server-side rendering (static-SSR) framework component, specifically inside the subsystem responsible for handling client-side validation metadata during form processing.

In a standard Blazor static-SSR architecture, the server renders HTML forms and processes incoming HTTP POST submissions by binding request parameters to server-side model definitions. To optimize performance across consecutive requests, the runtime caches validation metadata and form field identifiers in memory. This mechanism is intended to avoid redundant reflection and metadata resolution overhead for known, static model properties defined at compile time.

Classified under CWE-770 (Allocation of Resources Without Limits or Throttling), the vulnerability occurs because the validation subsystem registers incoming, potentially untrusted form field names directly into an application-wide singleton cache without enforcing capacity boundaries. Consequently, any internet-facing Blazor static-SSR endpoint that processes form validation exposes an unauthenticated attack surface capable of exhausting host memory.

When exploited, this flaw allows a remote actor with network access to force continuous heap expansion within the target dotnet host process. Once the allocated memory exceeds physical or container limits, the .NET runtime throws an unhandled System.OutOfMemoryException, terminating the worker process and causing a complete denial of service for all active clients.

The underlying root cause of CVE-2026-118748 is a mismatch between the lifecycle of untrusted HTTP request inputs and the lifetime of the service container storing derived validation state. In ASP.NET Core Dependency Injection (DI), services registered with a Singleton lifetime are instantiated once and persist in the Managed Heap (often migrating to Generation 2 or the Large Object Heap) for the entire duration of the application process.

During the execution of Blazor static-SSR client-side validation processing, the framework inspects form keys submitted in the HTTP request payload. Rather than validating that a submitted form field key corresponds to a pre-existing compiled model property before caching, the vulnerable code path accepts arbitrary field identifiers and inserts them as keys into an internal, singleton-scoped dictionary or lookup structure.

This singleton cache implementation lacks three fundamental defensive controls required for structures exposed to external input:

• Maximum Capacity Constraint: No upper limit (SizeLimit) is enforced on the total number of entries stored in the dictionary.
• Time-To-Live (TTL) Expiration: Entries lack absolute or sliding expiration timestamps, preventing stale keys from being purged over time.
• Cache Eviction Policy: The data structure does not implement an eviction algorithm such as Least Recently Used (LRU) or Least Frequently Used (LFU) to displace older entries when memory pressure increases.

Because the .NET Garbage Collector (GC) cannot reclaim memory referenced by an active singleton root, every unique field string submitted by a client becomes a permanent allocation in the process address space. Under sustained submission of pseudo-random field identifiers, heap consumption grows monotonically in proportion to the volume and string length of the unique parameter keys received.

While Microsoft's advisory references the general availability release tag (v11.0.0) rather than isolating a single diff hunk in the public CVE metadata, the architectural mechanics of unbounded singleton caching in ASP.NET Core follow a well-defined pattern. In vulnerable preview builds of .NET 11.0, form validation metadata resolution relies on an unbounded concurrent collection living inside a singleton service.

The following representative C# implementation illustrates the vulnerable design pattern compared against the bounded remediation strategy applied in ASP.NET Core runtime components:

// VULNERABLE PATTERN: Unbounded Singleton Storage of Untrusted Request Keys
public sealed class VulnerableSsrValidationCache // Registered as Singleton
{
    // ConcurrentDictionary grows indefinitely without size limits or eviction
    private readonly ConcurrentDictionary<string, ValidationMetadata> _fieldCache = new();
 
    public ValidationMetadata GetOrAddFieldMetadata(string untrustedFormFieldName)
    {
        // Attacker controls 'untrustedFormFieldName' via HTTP form submission.
        // Every unique key allocates a permanent entry in the Singleton dictionary.
        return _fieldCache.GetOrAdd(untrustedFormFieldName, key => 
            BuildMetadataForField(key));
    }
}

To remediate this class of vulnerability in .NET 11.0.0, the validation architecture must either restrict caching strictly to known compile-time model types (Type and PropertyInfo tuples) or enforce strict scoping and capacity limits:

// REMEDIATED PATTERN: Bounded Cache with Strict Model Verification or Request Scoping
public sealed class SecureSsrValidationCache
{
    private readonly MemoryCache _boundedCache = new(new MemoryCacheOptions
    {
        // Enforce an explicit upper bound on cache capacity
        SizeLimit = 1024,
        CompactionPercentage = 0.25
    });
 
    public ValidationMetadata? GetMetadataIfValidProperty(Type modelType, string fieldName)
    {
        // 1. Verify field corresponds to an actual declared property before caching
        PropertyInfo? prop = modelType.GetProperty(fieldName, BindingFlags.Public | BindingFlags.Instance);
        if (prop is null)
        {
            return null; // Reject arbitrary/dynamic attacker-supplied field names
        }
 
        // 2. Cache keyed by bounded (Type, PropertyInfo) or bounded MemoryCache with TTL
        string cacheKey = $"{modelType.FullName}:{prop.Name}";
        return _boundedCache.GetOrCreate(cacheKey, entry =>
        {
            entry.SetSize(1);
            entry.SetSlidingExpiration(TimeSpan.FromMinutes(10));
            return BuildMetadataForProperty(prop);
        });
    }
}

> [!NOTE] > In ASP.NET Core, model binding and validation caches are only safe in Singleton scope when keyed exclusively by reflection primitives (System.Type, PropertyInfo, or ParameterInfo), as the set of loaded types in an assembly is finite. Keying a singleton cache by raw string inputs derived from HttpContext.Request.Form directly introduces CWE-770.

Ensuring fix completeness requires verifying that no secondary lookup structures—such as validation message formatters, field identifier parsers, or antiforgery token state trackers—retain unvalidated form key strings beyond the lifetime of the individual HttpContext scope.

Exploiting CVE-2026-118748 requires no authentication, privileges, or complex timing conditions (AC:L/PR:N/UI:N). The only prerequisite is network reachability to an ASP.NET Core application running a vulnerable .NET 11.0 preview build that exposes a Blazor static-SSR form endpoint with validation processing enabled.

An attacker initiates the operation by identifying a target endpoint that accepts application/x-www-form-urlencoded or multipart/form-data POST requests (or query parameters processed by static-SSR form handling). Reconnaissance can be performed passively by inspecting rendered HTML pages for Blazor static-SSR markers, such as _handler form attributes or specific validation summary structures.

Once the endpoint is identified, the attacker generates a series of HTTP requests containing high-cardinality, pseudo-random field identifiers. Rather than sending a single oversized payload—which would be blocked by Kestrel's default MaxRequestBodySize (~30 MB) or FormOptions.ValueCountLimit (default 1024 keys per request)—the attacker distributes the allocations across thousands of legitimate-sized requests.

POST /account/register?_handler=RegisterForm HTTP/1.1
Host: vulnerable-target.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 145
 
dyn_field_9f8a7b6c1=val&dyn_field_3e2d1c0b2=val&dyn_field_4a5b6c7d3=val&dyn_field_8f9e0d1c4=val&__RequestVerificationToken=CfDJ8...

By staying beneath the per-request ValueCountLimit (e.g., submitting 500 unique keys per request) and transmitting requests concurrently over HTTP/2 or HTTP/3 multiplexed streams, the attacker bypasses standard request-size inspection filters. Each request appends 500 new entries to the singleton cache. After a sufficient number of requests, the process exhausts available system RAM or triggers its container cgroup memory limit (OOM killer on Linux), terminating the server.

The primary security impact of CVE-2026-118748 is a complete degradation and eventual loss of service availability, reflected in its CVSS v3.1 Base Score of 7.5 (HIGH) (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The vulnerability does not grant confidentiality (C:N) or integrity (I:N) access; an attacker cannot read arbitrary memory contents or modify application data through this vector.

However, the availability impact (A:H) is asymmetric and affects the entire hosting process rather than an isolated user session. Because ASP.NET Core hosts all concurrent requests within a single unified worker process (dotnet.exe or the application binary), an OutOfMemoryException or OS-level OOM termination kills all in-flight requests, drops active WebSocket/SignalR connections, and clears all volatile in-memory state across the application.

Even before the process crashes completely, severe performance degradation occurs as the Managed Heap fills. When Generation 2 memory reaches capacity, the .NET Garbage Collector enters continuous, blocking full-compaction cycles (GC.Collect(2, GCCollectionMode.Forced, blocking: true, compacting: true)). This condition causes extreme CPU spikes and induces multi-second application pauses (GC thrashing), effectively rendering the service unresponsive prior to final termination.

As of the publication date, the vulnerability is classified by Microsoft with an Exploit Code Maturity of Unproven (E:U), is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and has no publicly disclosed weaponized exploits.

Microsoft has addressed CVE-2026-118748 in the official general availability release of .NET 11.0.0 and Microsoft Visual Studio 2026 version 18.12.0. Organizations operating any .NET 11.0.0-preview.* or release candidate builds in staging or production environments must upgrade the .NET SDK and ASP.NET Core Runtime (Microsoft.AspNetCore.App) to version 11.0.0 or later immediately.

For environments where immediate runtime patching requires scheduled maintenance windows, administrators should implement compensating controls at the reverse proxy, Web Application Firewall (WAF), and ASP.NET Core middleware layers:

1. Enforce Strict Form Key Limits: Reduce the maximum number of form entries accepted per request using FormOptions.ValueCountLimit in Program.cs so that it matches the maximum number of fields genuinely required by the application's largest form:

builder.Services.Configure<FormOptions>(options =>
{
    // Default is 1024; reduce to the minimum required by your forms (e.g., 64)
    options.ValueCountLimit = 64;
    options.KeyLengthLimit = 128;
});

2. Deploy Endpoint Rate Limiting: Configure ASP.NET Core's built-in RateLimiter middleware (Microsoft.AspNetCore.RateLimiting) or upstream proxy throttling (YARP, NGINX, Azure Front Door) on POST endpoints handling Blazor static-SSR form submissions to bound the rate at which a single client IP or session can submit requests.

3. Process Supervision & Memory Quotas: Ensure container orchestrators (Kubernetes, Docker) and process managers (systemd, IIS Application Pools) are configured with automatic restart policies and strict memory ceiling alerts so that anomalous heap growth is detected early and worker processes recover automatically if terminated.