DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-70186: CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock

#security #cve #cybersecurity

CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock

Vulnerability ID: CVE-2026-70186
CVSS Score: 7.5
Published: 2026-10-13

ASP.NET Core contains a thread deadlock vulnerability (CWE-833) that allows an unauthenticated remote attacker to cause a denial of service over the network by exhausting server thread pool resources.

TL;DR

Unauthenticated remote requests can trigger inconsistent synchronization lock orders in ASP.NET Core execution paths, leading to permanent thread deadlocks and host application unresponsiveness.

Technical Details

  • CWE ID: CWE-833 (Deadlock)
  • CVSS v3.1 Score: 7.5 (High)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Attack Vector: Network (Unauthenticated)
  • Exploit Status: Unproven / No Public Functional Exploit
  • CISA KEV Status: Not Listed
  • Impact Category: Denial of Service (Thread Starvation)

Affected Systems

  • ASP.NET Core 8.0 (versions < 8.0.32)
  • ASP.NET Core 9.0 (versions < 9.0.21)
  • ASP.NET Core 10.0 (versions < 10.0.13)
  • Microsoft Visual Studio 2022 v17.14 (versions < 17.14.42)
  • Microsoft Visual Studio 2026 v18.10 (versions < 18.10.4)
  • ASP.NET Core 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
  • ASP.NET Core 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
  • ASP.NET Core 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
  • Microsoft Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)
  • Microsoft Visual Studio 2026: >= 18.10.0, < 18.10.4 (Fixed in: 18.10.4)

Mitigation Strategies

  • Upgrade ASP.NET Core runtime and SDK packages to versions 8.0.32, 9.0.21, or 10.0.13.
  • Update Microsoft Visual Studio 2022 to build 17.14.42 or Visual Studio 2026 to build 18.10.4.
  • Implement client connection limits and request timeout constraints at reverse proxy layer.

Remediation Steps:

  1. Identify all deployed applications compiled against or running on vulnerable ASP.NET Core versions.
  2. Apply official Microsoft security updates to host environments, container baselines, and developer workstations.
  3. Monitor thread pool performance metrics (e.g., ThreadPool.ThreadCount) using .NET EventCounters or OpenTelemetry to verify system stability post-patching.

References

Read the full report for CVE-2026-70186 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)