PT-2026-26328 · Microsoft+1 · Asp.Net Core+1

Isa Jafarov · CVE-2026-25667 · Published 2026-03-19 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions prior to 8.0.22 ASP.NET Core versions prior to 9.0.11

Description A remote attacker can cause excessive CPU consumption by sending a crafted QUIC packet. This is due to an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing within the Kestrel component.

Recommendations Update ASP.NET Core to version 8.0.22 or later. Update ASP.NET Core to version 9.0.11 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2026-04687

BIT-DOTNET-2026-25667

BIT-DOTNET-SDK-2026-25667

CVE-2026-25667

Affected Products

Asp.Net Core

Red Os

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25667.json · Exploit
• 🔥 https://github.com/IsaJafarov/Kestrel-DoS · Exploit
• https://github.com/dotnet/aspnetcore/commit/96ccc40a0e095424b19506e8268b9b1a3e23d6a7#diff-667d5b3693f93a0f706ab211428998b210862f9b885d917104d2013118312626 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25667 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-25667 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04687 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-2026-25667 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25667 · Vendor Advisory
• https://github.com/IsaJafarov/Q3Fuzz · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-dotnet8-0-cve-2026-25667-7.3 · Note
• https://twitter.com/CVEnew/status/2036024250038137010 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-dotnet8-0-cve-2026-25667-8.0 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-dotnet9-0-cve-2026-25667-7.3 · Note
• https://twitter.com/VulmonFeeds/status/2034723817545769015 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-dotnet9-0-cve-2026-25667-8.0 · Note