PT-2026-26328 · Microsoft · Asp.Net Core

Isa Jafarov · Published 2026-03-19 · Updated 2026-04-16 · CVE-2026-25667

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions prior to 8.0.22 ASP.NET Core versions prior to 9.0.11

Description A remote attacker can cause excessive CPU consumption by sending a crafted QUIC packet. This is due to an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing within the Kestrel component.

Recommendations Update ASP.NET Core to version 8.0.22 or later. Update ASP.NET Core to version 9.0.11 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2026-04687

BIT-DOTNET-2026-25667

BIT-DOTNET-SDK-2026-25667

CVE-2026-25667

Affected Products

Asp.Net Core

References · 10

• 🔥 https://github.com/IsaJafarov/Kestrel-DoS · Exploit
• https://github.com/dotnet/aspnetcore/commit/96ccc40a0e095424b19506e8268b9b1a3e23d6a7#diff-667d5b3693f93a0f706ab211428998b210862f9b885d917104d2013118312626 · Patch
• https://osv.dev/vulnerability/BIT-dotnet-2026-25667 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04687 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25667 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25667 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-25667 · Vendor Advisory
• https://github.com/IsaJafarov/Q3Fuzz · Note
• https://twitter.com/CVEnew/status/2036024250038137010 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034723817545769015 · Twitter Post