CVE-2025-36854

CVE-2025-36854 concerns an RCE in EOL ASP.NET caused by a race condition when closing an HTTP/3 stream while response data is still being written, leading to use-after-free. Affected are EOL ASP.NET 6.0.0–6.0.36, 8.0.0–8.0.8, and 9.0.0-preview.1.24081.5–9.0.0.RC.1; self-contained deployments are ...