CVE-2026-70186

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-70186) has been identified in ASP.NET Core's Kestrel web server, where crafted HTTP/3 stream reset or abort sequences from an unauthenticated client can deadlock connection handling and exhaust server threads.

Per CWE-833: Deadlock, the weakness is a product containing multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

This issue only affects ASP.NET Core 6.0 applications that have turned on HTTP/3 in Kestrel. In .NET 6, HTTP/3 is a preview feature that is off by default: an application must opt in to preview features, enable the HTTP/3 protocol on an endpoint, and run on a host with the msquic library available. Applications serving only HTTP/1.1 and HTTP/2 are not affected. Microsoft's advisory lists ASP.NET Core 8.0, 9.0 and 10.0 as affected; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions with HTTP/3 enabled, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application at version 6.0.46 or earlier that enables HTTP/3 in Kestrel.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.Server.Kestrel.Core
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46 (HTTP/3 enabled)
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in Kestrel's HTTP/3 stream handling, in the Http3Stream type.

When an HTTP/3 stream is reset or aborted, Kestrel tears it down: it stops the stream's output producer and closes the frame writer and transport. Kestrel ran that teardown while holding the stream's completion lock. The teardown also needs the output producer's lock, and the normal output path takes those two locks in the opposite order. When an abort and an output flush on the same stream overlapped, each thread could end up waiting for the lock the other held. A client that repeatedly resets or aborts streams in a crafted pattern could leave threads blocked this way until the server ran short of them.

The fix holds the completion lock only for the state change that marks the stream aborted, and runs the teardown outside it. Request completion now waits for any abort still in progress before the stream is returned to the pool and reused.

This vulnerability has been present since HTTP/3 support was introduced as a preview in ASP.NET Core 6.0.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• Turn off HTTP/3 on Kestrel endpoints until patched. It is a preview feature in .NET 6.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Kevin Gosse and Muhammad Abdul Rehman, as credited in Microsoft's advisory.