{"metadata": {"vulnerability": "CVE-2026-70186", "count": 28, "kinds": {"milestone": 9, "sighting": 4, "kev": 0, "other": 15}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-03T23:48:30.860Z", "date_only": false, "value": "2026-08-03T23:48:30.860Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-70186", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T11:56:15Z", "date_only": false, "value": "2026-10-13T11:56:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426", "record": "CVE-2026-70186", "field": "creation_timestamp", "uuid": "df782b36-91f3-46b2-924a-6a52908339ed", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426"}, {"timestamp": "2026-10-13T14:00:00Z", "date_only": false, "value": "2026-10-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70186", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T19:00:25.877Z", "date_only": false, "value": "2026-10-13T19:00:25.877Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-70186", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:19:32.847Z", "date_only": false, "value": "2026-10-13T19:19:32.847", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70186", "record": "FKIE_CVE-2026-70186", "field": "published"}, {"timestamp": "2026-10-13T20:53:19Z", "date_only": false, "value": "2026-10-13T20:53:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MF4X-W4GH-4656", "record": "GHSA-MF4X-W4GH-4656", "field": "published"}, {"timestamp": "2026-10-13T20:53:19Z", "date_only": false, "value": "2026-10-13T20:53:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MF4X-W4GH-4656", "record": "GHSA-MF4X-W4GH-4656", "field": "modified"}, {"timestamp": "2026-10-13T22:07:51.403Z", "date_only": false, "value": "2026-10-13T22:07:51.403559Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70186", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T22:07:51.403Z", "date_only": false, "value": "2026-10-13T22:07:51.403559Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70186", "record": "FKIE_CVE-2026-70186", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T22:16:35.912Z", "date_only": false, "value": "2026-10-13T22:16:35.912Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70186", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T22:30:58Z", "date_only": false, "value": "2026-10-13T22:30:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/2cfeaa4682ccef4ca355970b7600691d", "record": "CVE-2026-70186", "field": "creation_timestamp", "uuid": "8cd5d8bd-adeb-4dcf-a9c6-459946bf8807", "content": "# CVE-2026-70186: CVE-2026-70186: ASP.NET Core Denial of Service Vulnerability via Framework Deadlock\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70186\n\n## Summary\nASP.NET Core contains a thread deadlock vulnerability (CWE-833) that allows an unauthenticated remote attacker to cause a denial of service over the network by exhausting server thread pool resources.\n\n## TL;DR\nUnauthenticated remote requests can trigger inconsistent synchronization lock orders in ASP.NET Core execution paths, leading to permanent thread deadlocks and host application unresponsiveness.\n\n## Technical Details\n\n- **CWE ID**: CWE-833 (Deadlock)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n- **Attack Vector**: Network (Unauthenticated)\n- **Exploit Status**: Unproven / No Public Functional Exploit\n- **CISA KEV Status**: Not Listed\n- **Impact Category**: Denial of Service (Thread Starvation)\n\n## Affected Systems\n\n- ASP.NET Core 8.0 (versions < 8.0.32)\n- ASP.NET Core 9.0 (versions < 9.0.21)\n- ASP.NET Core 10.0 (versions < 10.0.13)\n- Microsoft Visual Studio 2022 v17.14 (versions < 17.14.42)\n- Microsoft Visual Studio 2026 v18.10 (versions < 18.10.4)\n- **ASP.NET Core 8.0**: >= 8.0.0, < 8.0.32 (Fixed in: `8.0.32`)\n- **ASP.NET Core 9.0**: >= 9.0.0, < 9.0.21 (Fixed in: `9.0.21`)\n- **ASP.NET Core 10.0**: >= 10.0.0, < 10.0.13 (Fixed in: `10.0.13`)\n- **Microsoft Visual Studio 2022**: >= 17.14.0, < 17.14.42 (Fixed in: `17.14.42`)\n- **Microsoft Visual Studio 2026**: >= 18.10.0, < 18.10.4 (Fixed in: `18.10.4`)\n\n## Mitigation\n\n- Upgrade ASP.NET Core runtime and SDK packages to versions 8.0.32, 9.0.21, or 10.0.13.\n- Update Microsoft Visual Studio 2022 to build 17.14.42 or Visual Studio 2026 to build 18.10.4.\n- Implement client connection limits and request timeout constraints at reverse proxy layer.\n\n**Remediation Steps:**\n1. Identify all deployed applications compiled against or running on vulnerable ASP.NET Core versions.\n2. Apply official Microsoft security updates to host environments, container baselines, and developer workstations.\n3. Monitor thread pool performance metrics (e.g., ThreadPool.ThreadCount) using .NET EventCounters or OpenTelemetry to verify system stability post-patching.\n\n## References\n\n- [Microsoft Security Response Center Vulnerability Guidance: CVE-2026-70186](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70186)\n- [CVE Record: CVE-2026-70186](https://www.cve.org/CVERecord?id=CVE-2026-70186)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70186) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/2cfeaa4682ccef4ca355970b7600691d"}, {"timestamp": "2026-10-13T23:17:59.340Z", "date_only": false, "value": "2026-10-13T23:17:59.340", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70186", "record": "FKIE_CVE-2026-70186", "field": "lastModified"}, {"timestamp": "2026-10-13T23:59:54.541Z", "date_only": false, "value": "2026-10-13T23:59:54.541309Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117436317301610407", "record": "CVE-2026-70186", "field": "creation_timestamp", "uuid": "50ef2a12-cd7f-43a1-90de-ca0e5eeada26", "content": "CVE-2026-70186 ASP.NET Core Denial of Service Vulnerability Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-70186https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70186#Microsoft #ASP.NETCore10.0 #ASP.NETCore8.0 #ASP.NETCore9.0 #MicrosoftVisualStudio2022version17.14 #MicrosoftVisualStudio2026version18.10#CVE_2026_70186#bot", "url": "https://infosec.exchange/users/cve/statuses/117436317301610407"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T01:49:33Z", "date_only": false, "value": "2026-10-14T01:49:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25", "record": "CVE-2026-70186", "field": "creation_timestamp", "uuid": "89663ade-03b8-4377-b74e-977945cca502", "url": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25"}, {"timestamp": "2026-10-15T22:25:15.632Z", "date_only": false, "value": "2026-10-15T22:25:15.632Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-70186", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T22:25:15.632Z", "date_only": false, "value": "2026-10-15T22:25:15.632Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70186", "field": "containers.cna.providerMetadata.dateUpdated"}]}