CVE-2026-70175

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.

An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.

Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

A vulnerability in ASP.NET Core due to improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.

Inconsistent interpretation of HTTP requests ('HTTP request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

ASP.NET Core has a Denial of Service (DoS) vulnerability that could lead to service overload and unavailability.

Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.

ASP.NET Core has incorrect default permissions that allow an authorized attacker to elevate privileges locally. The issue concerns the default permission configuration in the ASP.NET Core environment.

A vulnerability in ASP.NET Core involves allocation of resources without limits or throttling. An unauthenticated attacker can cause a denial of service over a network.