Will unauthenticated HTTP/3 deadlocks exhaust resources in ASP.NET Core 8, 9, and 10 Kestrel servers?

An unauthenticated remote attacker can exploit a deadlock vulnerability in ASP.NET Core Kestrel to deny service over a network, according to Microsoft’s official advisory. The threat actor sends crafted HTTP/3 reset or abort sequences that freeze connection handling. This leads to excessive blocked-thread creation, exhausting server resources and resulting in a complete denial of service for the targeted application.

How does the HTTP/3 deadlock occur?

The vulnerability stems from how Kestrel processes specific HTTP/3 traffic patterns. Attackers send malformed reset or abort sequences that cause the server’s connection handling logic to deadlock. As more requests arrive, the system creates blocked threads that cannot recover. This accumulation drains available resources, preventing the server from responding to legitimate traffic or performing other tasks.

Which versions and platforms are affected?

Microsoft lists affected packages across ASP.NET Core versions 8, 9, and 10. The flaw impacts Microsoft.AspNetCore.App.Runtime packages for Windows, Linux, and macOS architectures, including x64, arm64, and arm variants. Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12 are vulnerable. All architectures with HTTP/3 support are at risk.

What patched versions are available?

Developers can update to specific patched versions to resolve the issue. For ASP.NET Core 8, the fix is in version 8.0.32. ASP.NET Core 9 users should upgrade to 9.0.21. Those running ASP.NET Core 10 need to move to version 10.0.13. These updates apply to all listed runtime packages across Linux, Windows, and macOS platforms, closing the deadlock vector.

What steps should developers take now?

Teams should immediately audit their project dependencies for the affected Microsoft.AspNetCore.App.Runtime packages. Identify any instances running vulnerable versions and schedule an update to the patched releases. Monitor server logs for signs of unusual HTTP/3 traffic or sudden thread spikes. Ensure deployment pipelines include these security updates to prevent new builds from using flawed components.

What analysts watch for

Security teams usually monitor for sudden spikes in blocked threads or resource exhaustion on web servers handling HTTP/3 traffic. Analysts examine network logs for unusual patterns of reset or abort signals that do not correspond to normal client behavior. They check whether connection handling processes are hanging or failing to release resources. Reviewing thread dumps can reveal if specific request types are causing persistent deadlocks in the server runtime.

What to do and how to stay safe: Microsoft

• Update all ASP.NET Core runtime packages to the patched versions listed in the advisory.
• Monitor server performance metrics for signs of thread exhaustion or unresponsive connections.
• Review HTTP/3 traffic logs for abnormal reset or abort sequences from unknown sources.
• Verify that deployment configurations enforce the use of patched package versions.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-70186?

Microsoft assigns a CVSS 3.1 score of 7.5, which is rated as high severity.

Does this vulnerability require authentication?

No, the advisory states that an unauthenticated remote attacker can exploit this flaw.

Which ASP.NET Core versions need patching?

Versions 8.0.0-8.0.31, 9.0.0-9.0.20, and 10.0.0-10.0.12 require updates.