CVE-2026-25667

ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sen...

Original description

The description as published by the source.

ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami dotnet-sdk

[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.22"},{"introduced":"9.0.0"},{"fixed":"9.0.11"}]}]

Bitnami dotnet

[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.22"},{"introduced":"9.0.0"},{"fixed":"9.0.11"}]}]

References

advisory nvd.nist.gov
advisory github.com
package github.com
package github.com
patch github.com