The vulnerability CVE-2026-25667 affects ASP.NET Core Kestrel in Microsoft .NET versions prior to 8.0.22 and 9.0.11. It is caused by an incorrect exit condition in the HTTP/3 Encoder/Decoder stream processing logic when handling QUIC packets. This flaw allows a remote attacker to send a crafted QUIC packet that triggers excessive CPU consumption, resulting in a denial-of-service condition. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). No official patch or vendor advisory is currently provided in the input data.

The impact of this vulnerability is a denial-of-service condition caused by excessive CPU consumption on affected ASP.NET Core Kestrel servers. This can degrade service availability and potentially disrupt hosted applications. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure of the affected services to untrusted networks or applying network-level protections to mitigate crafted QUIC packets targeting HTTP/3 processing. Monitor vendor channels for updates and apply patches promptly once released.