CVE-2026-70186

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can cause a denial of service by exhausting server thread and memory resources without requiring specialized privileges. ASP.NET Core deployments on Red Hat Enterprise Linux are susceptible only when Kestrel is configured to directly listen on and accept HTTP/3 connections. In standard production environments where applications operate behind a reverse proxy terminating incoming traffic or where HTTP/3 is not explicitly enabled on the server endpoints, exposure to this flaw is significantly reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.