ASP.NET Core: Deadlock in Kestrel enables denial of service
Summary
A deadlock in Kestrel, the web server built into ASP.NET Core, can be triggered by an unauthenticated remote attacker. The attacker sends crafted HTTP/3 reset or abort sequences, which block connection handling and create many blocked threads. Repeated requests can exhaust server resources and make the application unresponsive. Only availability is affected, and internet-facing applications with HTTP/3 enabled are the highest priority.
Affected
- Microsoft ASP.NET Core 8.0.0 to 8.0.31
- Microsoft ASP.NET Core 9.0.0 to 9.0.20
- Microsoft ASP.NET Core 10.0.0 to 10.0.12
- Microsoft Visual Studio 2022 version 17.14.0 to 17.14.41
- Microsoft Visual Studio 2026 version 18.10.0 to 18.10.3
- .NET 6.0.0 to 6.0.46: unconfirmed. A third-party provider reports it as affected when HTTP/3 is enabled. Microsoft's list does not include .NET 6, and Ubuntu has deferred its assessment.
Fixed in
- ASP.NET Core 8.0.32 or later
- ASP.NET Core 9.0.21 or later
- ASP.NET Core 10.0.13 or later
- Visual Studio 2022 version 17.14.42 or later
- Visual Studio 2026 version 18.10.4 or later
- Update the package reference if an application references the vulnerable package directly
Workaround
- Microsoft documents no workaround; patching is the fix.
- A third-party provider recommends disabling HTTP/3 on Kestrel endpoints until patched. This is not confirmed by Microsoft.
Exploitation
- No evidence of exploitation in the wild found. The CVE is not listed in CISA KEV in the sources checked.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS differs by source: 0.85% and 0.96%.
Our recommendation
- Inventory .NET runtimes, SDKs and Visual Studio installations, including on developer machines.
- Patch to ASP.NET Core 8.0.32, 9.0.21 or 10.0.13, and to the fixed Visual Studio versions.
- Check whether HTTP/3 is enabled on Kestrel endpoints and consider disabling it until patched.
- Give priority to internet-facing applications and customer-facing portals and APIs.
- Verify .NET 6 exposure with your vendor, because its status is unconfirmed.
- Monitor availability and resource usage of affected services.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide CVE-2026-70186 msrc.microsoft.com
- GitHub .NET announcement issue 461 github.com
- GitHub Advisory GHSA-mf4x-w4gh-4656 github.com
- Ubuntu security CVE-2026-70186 ubuntu.com
- Red Hat Bugzilla 2548793 bugzilla.redhat.com
- HeroDevs vulnerability directory CVE-2026-70186 www.herodevs.com
- GitLab advisory CVE-2026-70186 advisories.gitlab.com
- Strix CVE-2026-70186 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:03.
Original description (NVD)
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.