High severity7.5NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-25667

Description

ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Microsoft/Net2 versions
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*range: >=8.0.0,<8.0.22
- (no CPE)range: <8.0.22, <9.0.11
Microsoft/ASP.NET Core Kestrelllm-create
Range: <8.0.22, <9.0.11
osv-coords2 versions
pkg:bitnami/dotnet pkg:bitnami/dotnet-sdk
>= 8.0.0, < 8.0.22+ 1 more
- (no CPE)range: >= 8.0.0, < 8.0.22
- (no CPE)range: >= 8.0.0, < 8.0.22

Patches

Vulnerability mechanics

References

github.com/dotnet/aspnetcore/commit/96ccc40a0e095424b19506e8268b9b1a3e23d6a7nvdPatch

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000