Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-70186.md

Created October 13, 2026 22:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/2cfeaa4682ccef4ca355970b7600691d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/2cfeaa4682ccef4ca355970b7600691d to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-70186: CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock - CVE Security Report
Raw
CVE-2026-70186.md

CVE-2026-70186: CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock

CVSS Score: 7.5 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-70186

Summary

ASP.NET Core contains a thread deadlock vulnerability (CWE-833) that allows an unauthenticated remote attacker to cause a denial of service over the network by exhausting server thread pool resources.

TL;DR

Unauthenticated remote requests can trigger inconsistent synchronization lock orders in ASP.NET Core execution paths, leading to permanent thread deadlocks and host application unresponsiveness.

Technical Details

  • CWE ID: CWE-833 (Deadlock)
  • CVSS v3.1 Score: 7.5 (High)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Attack Vector: Network (Unauthenticated)
  • Exploit Status: Unproven / No Public Functional Exploit
  • CISA KEV Status: Not Listed
  • Impact Category: Denial of Service (Thread Starvation)

Affected Systems

  • ASP.NET Core 8.0 (versions < 8.0.32)
  • ASP.NET Core 9.0 (versions < 9.0.21)
  • ASP.NET Core 10.0 (versions < 10.0.13)
  • Microsoft Visual Studio 2022 v17.14 (versions < 17.14.42)
  • Microsoft Visual Studio 2026 v18.10 (versions < 18.10.4)
  • ASP.NET Core 8.0: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
  • ASP.NET Core 9.0: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
  • ASP.NET Core 10.0: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
  • Microsoft Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)
  • Microsoft Visual Studio 2026: >= 18.10.0, < 18.10.4 (Fixed in: 18.10.4)

Mitigation

  • Upgrade ASP.NET Core runtime and SDK packages to versions 8.0.32, 9.0.21, or 10.0.13.
  • Update Microsoft Visual Studio 2022 to build 17.14.42 or Visual Studio 2026 to build 18.10.4.
  • Implement client connection limits and request timeout constraints at reverse proxy layer.

Remediation Steps:

  1. Identify all deployed applications compiled against or running on vulnerable ASP.NET Core versions.
  2. Apply official Microsoft security updates to host environments, container baselines, and developer workstations.
  3. Monitor thread pool performance metrics (e.g., ThreadPool.ThreadCount) using .NET EventCounters or OpenTelemetry to verify system stability post-patching.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment