Kestrel

Everything Patch Gazette has reported about Kestrel: 2 stories, newest first. Part of our Vulnerabilities coverage.

Microsoft updates ASP.NET Core 8, 9, 10 to fix remote DoS via HTTP/3 deadlock flaw CVE-2026-70186

Microsoft releases updates for ASP.NET Core 8, 9, and 10 to fix a high-severity deadlock flaw in the Kestrel server that allows remote denial of service.

Oct 14, 2026

Vulnerabilities

Microsoft patches Kestrel HTTP smuggling flaw CVE-2026-88092 for ASP.NET Core 8-11 on all platforms

Critical CVE-2026-88092 allows network tampering via Kestrel. Patches are now available for versions 8, 9, 10, and 11 across Windows, Linux, and macOS.

Oct 13, 2026