CVE-2026-70186

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.linux-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.osx-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-arm versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.osx-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-arm versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-arm versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.osx-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-arm versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.20

Description A deadlock in ASP.NET Core allows an unauthenticated remote attacker to cause a denial of service. By sending crafted HTTP/3 reset or abort sequences, the attacker can deadlock Kestrel connection handling. This can lead to excessive blocked-thread creation and exhaustion of server resources.

Recommendations Update Microsoft.AspNetCore.App.Runtime.linux-arm versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.linux-x64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.osx-x64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.win-arm versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.App.Runtime.linux-arm versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.linux-x64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.osx-x64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.win-arm versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.App.Runtime.linux-arm versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.linux-x64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.osx-x64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.win-arm versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.20 to version 9.0.21. Self-contained applications targeting any of the impacted versions must be recompiled and redeployed.