PT-2026-26328 · Microsoft · Asp.Net Core

Isa Jafarov · Publicado 2026-03-19 · Atualizado 2026-04-16 · CVE-2026-25667

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions prior to 8.0.22 ASP.NET Core versions prior to 9.0.11

Description A remote attacker can cause excessive CPU consumption by sending a crafted QUIC packet. This is due to an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing within the Kestrel component.

Recommendations Update ASP.NET Core to version 8.0.22 or later. Update ASP.NET Core to version 9.0.11 or later.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BDU:2026-04687

BIT-DOTNET-2026-25667

BIT-DOTNET-SDK-2026-25667

CVE-2026-25667

Produtos afetados

Asp.Net Core

Referências · 10

• 🔥 https://github.com/IsaJafarov/Kestrel-DoS · Exploit
• https://github.com/dotnet/aspnetcore/commit/96ccc40a0e095424b19506e8268b9b1a3e23d6a7#diff-667d5b3693f93a0f706ab211428998b210862f9b885d917104d2013118312626 · Correção
• https://github.com/IsaJafarov/Q3Fuzz · Nota
• https://osv.dev/vulnerability/BIT-dotnet-2026-25667 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036024250038137010 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034723817545769015 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-04687 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-25667 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25667 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-25667 · Aviso do Fabricante