CVE-2026-70186 · GHSA-mf4x-w4gh-4656

Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability

Risk score: 72/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.8%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Affected: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) >= 8.0.0, <= 8.0.31
Fix: Upgrade Microsoft.AspNetCore.App.Runtime.linux-arm to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 to 8.0.32; Mi…
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.AspNetCore.App.Runtime.linux-arm: Red, act today. Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

The flaws

CVE-2026-70186: Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
CVE-2026-70188: Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability (CVSS 9.1 · EPSS 1%)
CVE-2026-70175: Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.1 · EPSS 1%)
CVE-2026-96236: Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)

The fix

Fix: Upgrade Microsoft.AspNetCore.App.Runtime.linux-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-mu…

Who is exposed: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Run…

Where it stands

No known exploitation

Connects to

Same weakness: CWE-833 (CWE-833). 4 other warnings in 30 days

Why it is Amber

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: asp.net core, NuGet

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
Microsoft.AspNetCore.App.Runtime.linux-arm	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.osx-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.osx-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.win-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.win-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.win-x86	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.AspNetCore.App.Runtime.linux-arm	nuget	>= 10.0.0, <= 10.0.12	10.0.13

References

Original description

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.