Microsoft released an advisory in June 2026 describing improper handling of malformed HTTP/2 frames in ASP.NET Core Kestrel. The issue affects servers running .NET 9 and .NET 10 on Windows Server with IIS in-process hosting.

Affected applications can experience thread starvation or leak internal path information under sustained attack traffic. No authenticated access is required.

#Who Is Affected

  • Any ASP.NET Core 9 or 10 application using the default Kestrel server behind IIS
  • Sites that have not applied the June 2026 cumulative update for .NET 10
  • Applications still using the older in-process hosting model without the latest runtime

#Immediate Mitigation Steps

Apply the latest .NET 10 runtime and ASP.NET Core hosting bundle released on 2026-06-18. This patch corrects the frame parsing logic.

bash 
dotnet --list-runtimes
# Verify output shows 10.0.8 or newer

#IIS Configuration Hardening

Add the following setting to web.config to reject suspicious frames early:

xml 
<system.webServer>
  <aspNetCore processPath="dotnet" arguments=".\\MyApp.dll"
              stdoutLogEnabled="false">
    <handlerSettings>
      <handlerSetting name="rejectInvalidHttp2Frames" value="true" />
    </handlerSettings>
  </aspNetCore>
</system.webServer>

#Monitoring Recommendations

  • Enable failed request tracing for HTTP 400 and 431 responses
  • Watch Kestrel event logs for repeated 'Invalid HTTP/2 frame' entries
  • Set up alerts when request queue length exceeds 500 for more than 30 seconds

After deploying the update and configuration change, retest with your existing load-testing suite. The advisory is resolved in current GA releases; no further code changes are required for most applications.