Microsoft updates ASP.NET Core 8, 9, 10 to fix remote DoS via HTTP/3 deadlock flaw CVE-2026-70186

Microsoft has issued security updates for ASP.NET Core versions 8, 9, and 10 to address a high-severity deadlock vulnerability in the Kestrel web server. The flaw, tracked as CVE-2026-70186, allows unauthenticated remote attackers to deny service by sending crafted HTTP/3 reset or abort sequences.

What happened

Microsoft identified a deadlock issue within Microsoft.AspNetCore.Server.Kestrel.Core that impacts applications using HTTP/3 support. According to the official advisory, an unauthenticated attacker can exploit this by sending specific HTTP/3 reset or abort sequences. These crafted requests cause the Kestrel connection handling logic to deadlock.

Repeated exploitation leads to excessive blocked-thread creation, which exhausts server resources. This resource exhaustion results in a denial of service for the affected application. The vulnerability affects all architectures, including Windows, Linux, and macOS systems.

The flaw is classified as high severity with a CVSS 3.1 score of 7.5. It is mapped to CWE-833, which denotes deadlock conditions. Microsoft released patches for ASP.NET Core 8.0.32, 9.0.21, and 10.0.13 to resolve the issue.

This release follows recent patches for other ASP.NET Core flaws, including an email authentication issue in October 2026. As Patch Gazette reported on 2026-10-14, Microsoft previously fixed a high-severity identity flow flaw in versions 8, 9, and 10.

Why it matters

The vulnerability requires no authentication, making it accessible to any network-connected attacker. The impact is denial of service, which halts application availability for legitimate users. Because it affects the core Kestrel server, any ASP.NET Core application using HTTP/3 is potentially vulnerable.

The flaw impacts a wide range of runtime packages across multiple operating systems. Affected platforms include Linux ARM, ARM64, x64, and musl variants, as well as macOS and Windows. All architectures are at risk if they run the vulnerable package versions.

Organizations must update to the patched versions to prevent resource exhaustion. The affected version ranges are 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, and 10.0.0 to 10.0.12. Failure to patch leaves systems open to simple, repeatable attacks.

What to watch

• Monitor internal logs for spikes in blocked threads or connection timeouts on Kestrel servers.
• Check for any unusual HTTP/3 traffic patterns that could indicate exploitation attempts.
• Verify that all ASP.NET Core applications have been updated to the latest patched versions.
• Review network access controls to limit exposure of public-facing Kestrel endpoints.

Who needs to act first

Teams should prioritize updating public-facing systems that support HTTP/3 protocols. Identify all instances of ASP.NET Core versions 8, 9, and 10 running in production environments. Test the patched versions in staging environments before widespread deployment to ensure application compatibility. Back up current configurations and application data before applying updates. If immediate patching is not possible, consider disabling HTTP/3 support temporarily to reduce exposure to the specific attack vector.

What to do and how to stay safe: Microsoft

• Inventory all servers running ASP.NET Core to identify those using vulnerable versions 8.0.0-8.0.31, 9.0.0-9.0.20, or 10.0.0-10.0.12.
• Apply the latest security updates provided by Microsoft to patch CVE-2026-70186 on all affected platforms.
• Disable HTTP/3 support on Kestrel servers if immediate patching is not feasible to mitigate the risk.
• Monitor server performance metrics for signs of thread exhaustion or deadlock conditions after patching.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which ASP.NET Core versions are affected by CVE-2026-70186?

Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12 are affected.

What is the severity rating for this vulnerability?

The vulnerability is rated high severity with a CVSS 3.1 score of 7.5.

Does this flaw require authentication to exploit?

No, the flaw allows unauthenticated remote attackers to trigger the deadlock via crafted HTTP/3 sequences.