ASP.NET Core Kestrel Deadlock Flaw Risks Service Outages for Web Hosts

Microsoft has addressed a high-severity security flaw in its ASP.NET Core web server component, Kestrel. The vulnerability, identified as CVE-2026-70186, allows an unauthenticated attacker to trigger a deadlock in connection handling. This issue specifically targets systems utilizing HTTP/3 support. Organizations running web services on affected versions face the risk of service disruption.

The risk

The vulnerability stems from a deadlock condition within the Microsoft.AspNetCore.Server.Kestrel.Core package. According to the GitHub advisory, an attacker can send crafted HTTP/3 reset or abort sequences to exploit this weakness. These malicious requests cause the server to create excessive blocked threads. This thread exhaustion consumes server resources, leading to a denial of service. The CVSS score is 7.5, classifying the severity as high.

Who is exposed

The flaw impacts Microsoft .NET projects using specific runtime packages. Affected versions include ASP.NET Core 8.0 through 8.0.31, 9.0 through 9.0.20, and 10.0 through 10.0.12. The vulnerability exists across all architectures for Windows, Linux, and macOS. Any organization hosting web applications on these platforms with HTTP/3 enabled is potentially exposed to this remote attack vector.

Cost and compliance

The source material does not provide specific data regarding financial losses or regulatory compliance impacts associated with this vulnerability. The advisory focuses on the technical nature of the deadlock and the availability of patches. No information about active exploitation in the wild or specific victim organizations is included in the provided documents.

What happens next

Managers should verify the versions of ASP.NET Core running in their environments. If systems are on affected versions, they should apply the latest updates immediately. Patches are available for versions 8, 9, and 10. Ensuring all runtime packages are updated to the patched versions mitigates the risk of resource exhaustion and service unavailability.

Questions to ask your suppliers

Organizations should request confirmation that third-party vendors have updated their hosted services or software dependencies to address this deadlock vulnerability. Teams usually need to verify whether managed cloud providers have applied the necessary patches to underlying infrastructure. Check whether any custom applications rely on older runtime versions that may not receive automatic updates. Ensure that incident response plans include procedures for handling potential service disruptions caused by resource exhaustion.

What to do and how to stay safe: Microsoft

• Inventory all servers and containers running ASP.NET Core to identify versions 8, 9, or 10.
• Apply the latest runtime updates provided by Microsoft to patch the deadlock vulnerability.
• Monitor server logs for unusual spikes in blocked threads or HTTP/3 reset sequences.
• Verify that HTTP/3 support is only enabled on systems that have been updated to patched versions.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-70186?

It is a high-severity deadlock vulnerability in ASP.NET Core Kestrel that allows remote denial of service via crafted HTTP/3 requests.

Which versions are affected?

Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12 are vulnerable across Windows, Linux, and macOS.

Is there a fix available?

Yes, Microsoft has released patched versions 8.0.32, 9.0.21, and 10.0.13 to resolve the issue.