CVE-2026-114154: Denial of Service in ASP.NET Core HttpSys Request Header Processing

Vulnerability ID: CVE-2026-114154

CVSS Score: 7.5

Published: 2026-11-11

CVE-2026-114154 is a high-severity Denial of Service (DoS) and uncontrolled resource consumption vulnerability in the Microsoft.AspNetCore.Server.HttpSys component of ASP.NET Core. When processing an HTTP request that simultaneously contains a chunked Transfer-Encoding header, a Content-Length header, and an explicit X-Content-Length header, the server throws an unhandled ArgumentException during header normalization.…