EUVD-2026-99689
GHSA-mf4x-w4gh-4656
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTP/3-enabled Kestrel endpoint
-
DeliverySend crafted HTTP/3 reset/abort sequences
-
ExploitDeadlock Kestrel connection handling
-
ExecutionSpawn excessive blocked threads
-
ImpactExhaust server resources, denial of service
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires the target ASP.NET Core application to run Kestrel with HTTP/3 support enabled (affected packages Microsoft.AspNetCore.App.Runtime, versions 8.0.0-8.0.31, 9.0.x<9.0.21, 10.0.x<10.0.13 on Windows/Linux/macOS with HTTP/3); the network endpoint must be reachable by the attacker. No authentication, user interaction, or special privileges are needed (PR:N/UI:N) once HTTP/3 is exposed. The primary limiting factor is that HTTP/3 is not enabled by default in many Kestrel deployments, so applications serving only HTTP/1.1 or HTTP/2 are not exposed; impact is availability-only with no data exposure. |
| Impact | This is a moderate-priority network-reachable denial-of-service issue, not a confidentiality/integrity threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) indicates a remote, low-complexity, unauthenticated attack with availability-only impact - consistent with the GHSA advisory describing crafted HTTP/3 reset/abort sequences that deadlock Kestrel and exhaust threads. Signals partially conflict: public exploit code exists (a gist is referenced) and SSVC marks the flaw Automatable:yes, yet CISA's SSVC Exploitation status is 'none' and the CVE is NOT in CISA KEV, so there is no evidence of real-world active exploitation. SSVC Technical Impact is only 'partial', aligning with DoS (no code execution or data loss). The realistic risk is meaningfully gated by a precondition the CVSS vector does not capture: exploitation requires HTTP/3 to be enabled on Kestrel, which is not the default for many ASP.NET Core deployments. Net: treat as a prompt patch-management item for internet-facing HTTP/3-enabled services, but it is availability-only and not a critical emergency despite the 7.5 score. |
| Exploit ScenarioDerived | An unauthenticated remote attacker repeatedly sends crafted HTTP/3 reset or abort sequences to an internet-facing ASP.NET Core application running Kestrel with HTTP/3 enabled. The malformed sequences deadlock connection handling and spawn excessive blocked threads, exhausting server resources until the service stops responding. Public proof-of-concept exploit code is referenced, lowering the barrier to reproduction, though CISA SSVC records no observed exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in ASP.NET Core's Kestrel web server allows an unauthenticated remote attacker to deadlock connection handling by sending crafted HTTP/3 reset or abort sequences, causing excessive blocked-thread creation and eventual server resource exhaustion. The flaw affects applications built on Microsoft.AspNetCore.App.Runtime 8.0.x before 8.0.32, 9.0.x before 9.0.21, and 10.0.x before 10.0.13 on Windows, Linux, and macOS, but only when Kestrel is running with HTTP/3 support enabled - servers limited to HTTP/1.1 or HTTP/2 are not exposed. Publicly available exploit code exists (a public gist demonstrates the issue), and the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact with no confidentiality or integrity loss; there is no confirmed active exploitation at time of analysis.
RemediationAI
Vendor-released patches are available: upgrade Microsoft.AspNetCore.App.Runtime to 8.0.32, 9.0.21, or 10.0.13 depending on your targeted framework, update Microsoft Visual Studio 2022 (17.14 branch) to 17.14.42 and Visual Studio 2026 (18.10 branch) to 18.10.4, and then redeploy or rebuild affected applications so the patched shared framework is loaded - advisory details and package-by-package fix tables are at https://github.com/dotnet/aspnetcore/security/advisories/GHSA-mf4x-w4gh-4656 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70186. If patching must be deferred, the most effective compensating control is to disable the HTTP/3 listener in Kestrel (or bind only HTTP/1.1/HTTP/2 endpoints); the trade-off is loss of QUIC's reduced-latency and connection-migration benefits for clients, and any load balancer or CDN advertising HTTP/3 must be reconfigured to stop forwarding QUIC traffic. As a secondary measure, block or rate-limit inbound UDP/443 at the network edge where HTTP/3 is not required, accepting that this degrades legitimate QUIC clients, and front the affected service with a proxy or reverse proxy that terminates HTTP/3 itself so malformed reset/abort sequences never reach the vulnerable Kestrel build - noting that the proxy then becomes the endpoint whose QUIC handling must be trusted. Because public exploit code exists, prioritize external-facing services that have HTTP/3 enabled over internal-only or HTTP/1.1-HTTP/2 deployments when sequencing patch rollouts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 16 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability class is CWE-833 (Deadlock), rooted in the connection-handling logic of Microsoft.AspNetCore.Server.Kestrel.Core, the cross-platform HTTP server that backs ASP.NET Core applications. Kestrel's HTTP/3 support is built on QUIC, which runs over UDP rather than TCP, and exposes stream reset and abort primitives that HTTP/1.1 and HTTP/2 do not have in the same form. Crafted reset or abort sequences drive Kestrel's connection state machine into a deadlock; because the blocked work items never complete, the runtime keeps allocating threads that park indefinitely, producing thread-pool starvation and resource exhaustion rather than memory corruption or code execution. The CVSS vector (PR:N/UI:N, AC:L) confirms that no credentials, privileges, or user interaction are needed once the HTTP/3 endpoint is reachable, and the scope is unchanged with availability as the sole impacted metric. Affected components are the Microsoft.AspNetCore.App.Runtime shared framework packages for all runtime identifiers (linux-x64, linux-arm, linux-arm64, linux-musl-x64/arm/arm64, osx-x64, osx-arm64, win-x64/arm/arm64, and related RIDs), meaning any self-contained or framework-dependent ASP.NET Core deployment consuming those packages inherits the defect. The primary exposure-limiting factor is deployment configuration: HTTP/3 is not enabled by default in many Kestrel setups, so the practical attack surface is limited to services that explicitly opted into QUIC/HTTP3 listeners.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote attacker sends crafted HTTP/3 sequences (AV:N, PR:N, UI:N, AC:L); impact is availability-only deadlock/resource exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Technical POC Analysis
Evidence caveat up front: the supplied material is the GHSA advisory plus a gist that is an auto-generated CVE report.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A high-severity denial-of-service flaw in the Kestrel web server that ships with ASP.NET Core lets any unauthenticated internet user exhaust server resources and stall connection handling on .NET applications that serve traffic over HTTP/3. Because publicly available exploit code exists and no credentials are needed, any internet-facing or partner-facing .NET service with HTTP/3 enabled is a plausible near-term target, and an outage would be visible directly to customers and dependent business processes. Applications restricted to HTTP/1.1 or HTTP/2 are not exposed, which makes the affected footprint a scoping question that engineering can answer quickly.
Apply vendor patch. Until patched, disable HTTP/3 on affected Kestrel-hosted services (HTTP/1.1 or HTTP/2 only), restrict exposure of HTTP/3 endpoints at the edge, and apply rate limiting and connection-limit controls with thread-pool exhaustion monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB