CVE-2026-69304: Denial of Service via Request Decompression Data Amplification in ASP.NET Core

ASP.NET Core provides support for transparent decompression of incoming HTTP request bodies through specialized middleware and hosting integrations. This capability enables servers to dynamically unpack payloads compressed using standard algorithms such as GZIP, Deflate, and Brotli. By processing these payloads on-the-fly, applications can reduce bandwidth utilization and improve throughput for clients operating under restricted network conditions.

The vulnerability identified as CVE-2026-69304 stems from improper resource management during the decompression phase. The flaw resides in how the web host handles highly compressed, redundant data structures, commonly classified under CWE-409 (Improper Handling of Highly Compressed Data). Under specific conditions, the decompression libraries inflate incoming payloads without validating the output volume against the resource constraints of the system.

The attack surface is exposed to unauthenticated remote attackers who can send crafted HTTP requests directly to endpoints utilizing request decompression. Because decompression occurs early in the request-processing pipeline, the server allocates resources before performing authentication, routing, or authorization checks. This structural design amplifies the impact of the flaw, as arbitrary network actors can trigger resource exhaustion with minimal cost.

The root cause of CVE-2026-69304 lies in the sequential read and expansion mechanisms of .NET decompression streams, including GzipStream, DeflateStream, and BrotliStream. When an HTTP request containing a 'Content-Encoding: gzip' header is processed, the ASP.NET Core request decompression middleware wraps the incoming network stream in an instance of the corresponding decompression class. The wrapper then reads the compressed bytes and reconstructs the original uncompressed payload in system memory.

The vulnerability occurs because the original decompression stream wrapper did not correlate the size of the compressed network payload with the cumulative length of the decompressed output. Decompression algorithms function by replacing repeating sequences of data with short pointer references. A malicious payload can contain long strings of repeating characters, such as zero bytes, which compress down to a few kilobytes but expand to multiple gigabytes of memory upon decompression.

During processing, as the server continuously pulls data from the decompression stream, it repeatedly allocates heap buffers to accommodate the rapidly expanding output. If the decompressed size exceeds available physical RAM, the .NET Garbage Collector becomes overloaded attempting to reclaim memory, leading to severe CPU starvation. Ultimately, the hosting runtime encounters an unhandled OutOfMemoryException, causing the worker process to terminate and resulting in a denial-of-service condition.

To visualize the progression of an incoming compressed payload through the vulnerable stack, the sequence of events is illustrated below:

The fundamental defect is the absence of a size-limiting boundary within the decompression loop. The framework read the stream until the end of the payload was reached, relying on the client-supplied structure rather than defensive runtime constraints. The listing below represents a conceptual contrast between the vulnerable structure and the patched stream wrapper implementation:

// VULNERABLE: Reads decompression stream without tracking inflated output size
public async Task DecompressRequestAsync(HttpContext context, Stream compressedStream)
{
    using (var decompressor = new GzipStream(compressedStream, CompressionMode.Decompress))
    {
        // The buffer expands dynamically without size checks
        await decompressor.CopyToAsync(context.Response.Body);
    }
}
 
// PATCHED: Implements a size-limiting wrapper to enforce strict thresholds
public async Task DecompressRequestPatchedAsync(HttpContext context, Stream compressedStream, long maxLimit)
{
    // The framework wraps the decompression stream in a size-limiting stream
    using (var decompressor = new GzipStream(compressedStream, CompressionMode.Decompress))
    using (var limitedStream = new SizeLimitingStream(decompressor, maxLimit))
    {
        try
        {
            await limitedStream.CopyToAsync(context.Response.Body);
        }
        catch (InvalidDataException ex)
        {
            // Abruptly terminates the connection and reclaims memory resources
            context.Abort();
            throw new InvalidOperationException("Decompressed body size limit exceeded.", ex);
        }
    }
}

In the patched version, the SizeLimitingStream monitors the accumulated decompressed byte count during each read operation. If the decompressed byte count surpasses the configured limit (such as MaxRequestBodySize), the stream immediately raises an exception. This early termination prevents further memory allocations, discards the half-processed stream, and closes the connection to preserve host resources.

Exploitation of CVE-2026-69304 does not require valid credentials, administrative privileges, or complex pre-conditions. The primary requirement is that the targeted ASP.NET Core application must have request decompression explicitly configured and enabled. This is typical in applications that process high-volume API telemetry or large document uploads from remote clients.

An attacker begins by preparing a payload containing highly redundant, repeatable byte sequences, such as continuous arrays of hexadecimal zeros. Using a compression utility, the attacker compresses this payload, achieving an extremely high data amplification ratio (often exceeding 1:1000). The resulting compressed file remains exceptionally small, typically measuring less than 10 kilobytes, which easily bypasses standard network packet length restrictions.

The attacker then transmits this payload to any exposed endpoint on the target server using an HTTP POST or PUT request. The request is sent with the header 'Content-Encoding: gzip' (or 'deflate' / 'br') to instruct the ASP.NET Core middleware to initiate decompression. Upon receipt, the middleware immediately invokes the vulnerable stream handlers, triggering unbounded memory allocations on the server's heap until resource starvation occurs.

The primary impact of CVE-2026-69304 is a complete Denial of Service (DoS) affecting the availability of the web application. Because the runtime runs out of memory, the underlying operating system or IIS process manager terminates the worker process. In out-of-process hosting environments, this leads to persistent HTTP 502 (Bad Gateway) errors for all subsequent legitimate incoming requests.

The CVSS v3.1 base score is calculated as 5.9 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The Attack Complexity is classified as High (AC:H) because exploitation depends on the specific operational configuration where request decompression is actively enabled. The impact metrics are isolated to Availability, while Confidentiality and Integrity remain unaffected.

Additionally, this vulnerability presents detection challenges for security operations centers. Standard signature-based Web Application Firewalls (WAF) inspect incoming requests based on size and typical exploit patterns. Because the payload size of a decompression bomb is extremely small, it often passes through security boundaries undetected, only revealing its destructive nature once processed by the internal application server.

Remediation of CVE-2026-69304 is achieved primarily by updating the underlying .NET SDK and hosting runtimes. Administrators must apply the relevant security updates released by Microsoft: upgrade to .NET 10.0.12 or higher, .NET 9.0.20 or higher, or .NET 8.0.31 or higher. Rebuilding and redeploying the application with these patched SDKs ensures that the decompression wrapper streams implement the necessary size validations.

If immediate patching is not feasible, administrators can apply temporary workarounds to reduce risk. The most direct workaround is to disable the request decompression middleware globally within the application's configuration file (typically 'Program.cs' or 'Startup.cs'). This is done by removing or commenting out the 'app.UseRequestDecompression()' middleware registration.

Alternatively, administrators should configure strict request size limits on the Kestrel server or the reverse proxy. By setting the 'MaxRequestBodySize' limit, the application will reject oversized incoming payloads before they can undergo decompression. Implementing deep packet inspection or rate-limiting rules at the reverse proxy (such as Nginx or HAProxy) can also block compressed payloads destined for endpoints that do not require them.