UpHeron
All vulnerabilities

Servers and applications

CVE-2026-25667

ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.

Severity
High 7.5
Published
19 Mar 2026
Last changed
17 Jun 2026
Added to UpHeron
22 Oct 2026
Fixed in
8.0.22, 9.0.11
Sources
NVD

Affected software

SoftwareAffected versions
.NETServers and applications · cpe:a:microsoft:.net
  • From 8.0.0 before 8.0.22
  • From 9.0.0 before 9.0.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-25667
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-25667