CVE-2025-26682

Overview

ASP.NET Core is a cross-platform, high-performance, open-source framework for building modern, cloud-enabled, internet-connected apps. It is part of the .NET platform and includes Kestrel, the cross-platform web server that hosts ASP.NET Core applications.

A Denial of Service vulnerability (CVE-2025-26682) has been identified in Kestrel's HTTP/3 implementation, which allows an unauthorized attacker to deny service over a network. A peer can declare an arbitrarily large frame on an HTTP/3 control stream and then send its payload slowly, and the server accumulates the whole declared size before processing any of it.

Per CWE-770: Allocation of Resources Without Limits or Throttling, the product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated.

This issue affects .NET 6. Kestrel's HTTP/3 support ships in the Microsoft.AspNetCore.App shared framework, but reaching it requires an explicit opt-in: HTTP/3 must be configured on the listener, the QUIC transport's API is marked as a preview feature and needs EnablePreviewFeatures, and msquic must be present. Applications that have not enabled HTTP/3 are not exposed.

‍

Details

Module Info

• Product: ASP.NET Core
• Affected packages: Microsoft.AspNetCore.Server.Kestrel.Core (ships in the Microsoft.AspNetCore.App shared framework)
• Affected versions: Microsoft.AspNetCore.App >= 6.0.0 <= 6.0.44
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.45

Vulnerability Info

This High-severity vulnerability is found in Kestrel's HTTP/3 frame reader. Http3FrameReader.TryReadFrame refuses to hand a frame to the caller until the whole declared payload has been buffered, returning false while it waits. Http3ControlStream drives that reader in a loop and keeps reading from the connection each time it returns false, so the declared length, not the data actually sent, determines how much the connection holds.

Nothing rejects the declaration and nothing bounds the accumulation, so a small amount of attacker traffic holds a large and growing allocation. Control stream frames such as SETTINGS and GOAWAY are small by design, which is what makes an oversized declaration recognisable as hostile.

The fixed release rejects an oversized control stream frame as soon as its declared length can be read, before any payload is buffered, and closes the connection with an HTTP/3 frame error. The limit matches the one applied upstream.

Applicability to .NET 6 was established from source and confirmed against the shipped artifact: driving the 6.0.44 parser with a frame declaring 1 GiB and supplying eight bytes returned false and yielded nothing, leaving the caller to keep buffering. Microsoft's published affected-version list names only ASP.NET Core 8 and 9.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • ASP.NET Core >= 8.0.15
  • ASP.NET Core >= 9.0.4
• Disable HTTP/3 on Kestrel listeners, which removes the affected code path entirely.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.45 or later.

‍

Credits

Microsoft did not publicly credit an individual finder for this vulnerability in its security advisory.