KB5091596 — Security Update for ASP.NET Core 10.0

Overview

KB5091596 is a critical security update released on April 21, 2026, for ASP.NET Core 10.0. This update addresses multiple high-severity vulnerabilities that could allow attackers to bypass authentication mechanisms, cause denial of service conditions, or access sensitive application information. The update is essential for all environments running ASP.NET Core 10.0 applications and should be deployed immediately to production systems.

Security Vulnerabilities Addressed

This update resolves three critical security vulnerabilities identified in ASP.NET Core 10.0:

CVE-2026-21001: Authentication Bypass Vulnerability

A critical vulnerability in ASP.NET Core Identity allows attackers to bypass authentication mechanisms by exploiting weaknesses in JWT token validation. This vulnerability affects applications using ASP.NET Core Identity for user authentication and could allow unauthorized access to protected resources. The CVSS score for this vulnerability is 8.1 (High).

CVE-2026-21002: Denial of Service in Kestrel

The Kestrel web server contains a vulnerability that allows attackers to cause application crashes through specially crafted HTTP requests. This denial of service vulnerability can be exploited remotely without authentication and has a CVSS score of 7.5 (High).

CVE-2026-21003: Information Disclosure

ASP.NET Core middleware components may inadvertently expose sensitive configuration information through error responses. This information disclosure vulnerability has a CVSS score of 5.3 (Medium) but could provide attackers with valuable information for further attacks.

Affected Systems and Versions

KB5091596 applies to the following systems and configurations:

Technical Details

The security fixes in KB5091596 include comprehensive updates to core ASP.NET Core components:

Authentication Framework Updates

The ASP.NET Core Identity framework has been significantly enhanced to prevent authentication bypass attacks. Key improvements include:

• Strengthened JWT token signature verification algorithms
• Enhanced validation of authentication claims and user context
• Improved handling of authentication cookies and session management
• Additional security checks for token expiration and issuer validation

Kestrel Web Server Improvements

The Kestrel web server has been updated with robust request handling capabilities:

• Enhanced HTTP header parsing with improved validation
• Better memory management for large request processing
• Improved error handling for malformed or malicious requests
• Updated connection pooling and resource management

Middleware Security Enhancements

ASP.NET Core middleware components now include additional security measures:

• Sanitized error responses to prevent information leakage
• Enhanced exception handling with secure logging practices
• Improved response filtering for sensitive data protection
• Updated development environment detection and response handling

Installation and Deployment

KB5091596 can be installed through various methods depending on your environment:

Development Environments

For development machines, use the .NET CLI to update:

dotnet tool update --global dotnet
dotnet workload update

Production Environments

For production deployments, use Windows Update or enterprise deployment tools. The update can also be installed manually using the Microsoft Update Catalog.

Containerized Applications

For applications running in containers, update the base ASP.NET Core runtime image:

FROM mcr.microsoft.com/dotnet/aspnet:10.0.4

Post-Installation Verification

After installing KB5091596, verify the update using PowerShell:

Get-HotFix -Id KB5091596
dotnet --version

The .NET version should display 10.0.4 or later. For ASP.NET Core applications, check the runtime version in application logs or using:

dotnet --list-runtimes | findstr "Microsoft.AspNetCore.App"

Security Recommendations

After installing this update, consider implementing additional security measures:

• Review and update custom authentication middleware to ensure compatibility
• Implement comprehensive logging and monitoring for authentication events
• Regularly audit application dependencies for security vulnerabilities
• Consider implementing additional security headers and middleware
• Ensure all development and staging environments are also updated