high7.5

CVE-2026-70186

Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability

Impact

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Ecosystem	Package	Affected	Fixed in
nuget	`Microsoft.AspNetCore.App.Runtime.linux-arm`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-musl-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.linux-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.osx-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.osx-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-arm64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-x64`	>= 8.0.0, <= 8.0.31	8.0.32
nuget	`Microsoft.AspNetCore.App.Runtime.win-x86`	>= 8.0.0, <= 8.0.31	8.0.32

Vendor	Product	Affected versions
Microsoft	Microsoft Visual Studio 2022 Version 17.14	from 17.14.0 before 17.14.42
Microsoft	ASP.NET Core 9.0	from 9.0 before 9.0.21
Microsoft	ASP.NET Core 10.0	from 10.0 before 10.0.13
Microsoft	Microsoft Visual Studio 2026 Version 18.10	from 18.10.0 before 18.10.4
Microsoft	ASP.NET Core 8.0	from 8.0 before 8.0.32