StackRadar

CVE-2026-70186

High

Advisory

Published 13 Oct 2026In the index since 14 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
81
of 18,117 indexed, latest versions
Container images
101
deployed by those charts
Fix available
2 of 2
affected packages

Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability

Carried by container images the latest versions of 81 of 18,117 indexed charts deploy, on 101 images.

Affected packageAffected versionsFixed inImages
Microsoft.AspNetCore.App.Runtime.linux-x64nuget8.0.3, 8.0.4, 8.0.8, 8.0.10+12 more8.0.32, 9.0.21, 10.0.1358
Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget8.0.30, 9.0.11, 9.0.15, 9.0.20+2 more8.0.32, 9.0.21, 10.0.1343
OSV records
GHSA-mf4x-w4gh-4656

Charts affected

81 by stars
ChartLatestAffected imagesRadar Score
ms-users-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-users-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
codedesignplus/ms-users-rest:latest38a44b940cf6
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@9.0.20
9.0.21

Open the chart page →

210
ms-users-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-users-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
codedesignplus/ms-users-worker:latest4e8463697def
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@9.0.20
9.0.21

Open the chart page →

210
technitiumdeimosfr-charts15.5.11 of 1See more

technitium deimosfr-charts 15.5.1

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
technitium/dns-server:15.5.1b8efe03a5e3b
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

887
backbone-helm-chartenmeshed-backboneVerified publisher7.2.37 of 7See more

backbone-helm-chart enmeshed-backbone 7.2.3

7 of the 7 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ghcr.io/nmshd/backbone-admin-cli:7.2.3eb959d566216
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
ghcr.io/nmshd/backbone-admin-ui:7.2.3462b7b384ee6
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
ghcr.io/nmshd/backbone-consumer-api:7.2.3c3af06abdae7
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
ghcr.io/nmshd/backbone-database-migrator:7.2.39584941d1977
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
ghcr.io/nmshd/backbone-event-handler:7.2.3763550d9b404
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
ghcr.io/nmshd/backbone-housekeeper:7.2.38a5e3258fc66
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
ghcr.io/nmshd/backbone-identity-deletion-jobs:7.2.3734d28a296d9
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13

Open the chart page →

6,063
nethermindethereum-helm-chartsVerified publisher1.1.21 of 2See more

nethermind ethereum-helm-charts 1.1.2

1 of the 2 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
nethermind/nethermind:latest25f72063f6fc
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

787
garge-apigargeVerified publisher0.1.661 of 1See more

garge-api garge 0.1.66

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sondresjo/garge-api:v2.16.14299b540971b
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

1,138
garge-operatorgargeVerified publisher0.1.411 of 1See more

garge-operator garge 0.1.41

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sondresjo/garge-operator:v1.12.1a414ee2a3d5e
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

609
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-accountingservice6d051840bb29
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.10
8.0.32

Open the chart page →

58,805
smtp4devimioVerified publisher0.1.11 of 1See more

smtp4dev imio 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
rnwood/smtp4dev:3.6.1912304153668
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.4
8.0.32

Open the chart page →

3,587
innago-vault-k8s-role-operatorinnagoVerified publisher2.0.51 of 1See more

innago-vault-k8s-role-operator innago 2.0.5

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ghcr.io/innago-property-management/innago-vault-k8s-role-operator:2.0.0ed1c3fd04057
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@9.0.11
9.0.21

Open the chart page →

1,219
archisteamfarmjuniorjpdj0.1.1371 of 1See more

archisteamfarm juniorjpdj 0.1.137

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ghcr.io/justarchinet/archisteamfarm:6.3.10.4af5d4b28ef3a
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

609
rdt-clientk8s-home-lab-repo1.2.31 of 1See more

rdt-client k8s-home-lab-repo 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ghcr.io/rogerfar/rdtclient:2.0.1388232cb0ddcf5
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.0
10.0.13

Open the chart page →

353
zileank8s-home-lab-repo1.0.11 of 1See more

zilean k8s-home-lab-repo 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ghcr.io/thoroslives/zilean:v3.10.1bce6aca0f6ca
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@9.0.15
9.0.21

Open the chart page →

2,327
cleanuparrmedia-servarrVerified publisher0.20.11 of 1See more

cleanuparr media-servarr 0.20.1

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ghcr.io/cleanuparr/cleanuparr:2.10.9cfada3e57214
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

2,037
session-scalermiqm0.1.01 of 1See more

session-scaler miqm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
miqm/session-scaler:0.1.0c5c211717d9b
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.3
8.0.32

Open the chart page →

3,572
helmmirasys-chart0.1.01 of 4See more

helm mirasys-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sepehrmdn/mirasys-assignment:1.0.12567228e33c8
Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.11
9.0.21

Open the chart page →

4,627
notifynl-omcnotifynlOfficialVerified publisher0.4.381 of 1See more

notifynl-omc notifynl 0.4.38

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
worthnl/notifynl-omc:2.3.1e4e232b4aab9
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

609
nadekobotryuunosukeds30.1.21 of 2See more

nadekobot ryuunosukeds3 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
ryuunosukeds3/nadeko-bot-docker:latestc0398f13e8a9
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.13
8.0.32

Open the chart page →

9,658
serviceexamplesathya0.1.11 of 1See more

serviceexample sathya 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sathyafire/serviceexample:latest9f023bf424b3
Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.11
9.0.21

Open the chart page →

2,456
serviceexampleserviceexample-chart0.3.01 of 4See more

serviceexample serviceexample-chart 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
tibyandocker/serviceexample:latesta4ad592cea84
Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.15
9.0.21

Open the chart page →

4,261
service-exampleservice-example-jt0.1.11 of 9See more

service-example service-example-jt 0.1.1

1 of the 9 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
janzo83/serviceexample:latestfb3c4ac36f3e
Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.11
9.0.21

Open the chart page →

10,454
nethermindstakewise2.8.21 of 3See more

nethermind stakewise 2.8.2

1 of the 3 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
nethermind/nethermind:1.31.893e57917371a
Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.4
9.0.21

Open the chart page →

2,478
dotstatsuitestatcan0.2.81 of 6See more

dotstatsuite statcan 0.2.8

1 of the 6 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
siscc/dotstatsuite-core-transfer:master238449cc9f33
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

5,091
fdi-dotstatsuitestatcan0.3.53 of 3See more

fdi-dotstatsuite statcan 0.3.5

3 of the 3 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
siscc/dotstatsuite-core-auth-management:master9c334b91d745
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
siscc/dotstatsuite-core-transfer:master238449cc9f33
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
siscc/sdmxri-nsi-maapi:master6cf1145566f0
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@8.0.30
8.0.32

Open the chart page →

928
altinnendata-apitumogroup0.1.211 of 1See more

altinnendata-api tumogroup 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sondresjo/altinnendata-api:v1.8.4401fabc6aa5e
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

609
bobby-apitumogroup1.0.11 of 1See more

bobby-api tumogroup 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sondresjo/bobby-api:latestfe534731909a
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.17
8.0.32

Open the chart page →

2,687
nstuning-apitumogroup0.1.261 of 1See more

nstuning-api tumogroup 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sondresjo/nstuning-api:v1.7.2ce827dcb8284
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

609
pyttogpanne-apitumogroup0.1.71 of 1See more

pyttogpanne-api tumogroup 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
sondresjo/pyttogpanne-api:v1.0.54789c6031d93
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13

Open the chart page →

609
umbrella-chartumbrella-chartVerified publisher0.1.13 of 5See more

umbrella-chart umbrella-chart 0.1.1

3 of the 5 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
hassroutyyoussef/accountservice:latest1f01edf1ee0c
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.11
8.0.32
hassroutyyoussef/orderservice:latest2fc3d1617928
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.11
8.0.32
hassroutyyoussef/userservice:lateste0392e2b4a90
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.11
8.0.32

Open the chart page →

8,628
welcome-apiwelcome-api7.0.01 of 1See more

welcome-api welcome-api 7.0.0

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
lucassandin/welcome-api:latest04551c5d5881
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.4
8.0.32

Open the chart page →

3,506
reflectorwenerme10.0.651 of 1See more

reflector wenerme 10.0.65

1 of the 1 container images this version deploys carry CVE-2026-70186.

Container imageDigestPackageFixed in
emberstack/kubernetes-reflector:10.0.6551dbd5880929
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.11
10.0.13

Open the chart page →

1,009

Container images carrying it

101 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.10
8.0.32
1
sepehrmdn/mirasys-assignment:1.0.12567228e33c8
Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.11
9.0.21
1
siscc/dotstatsuite-core-auth-management:master9c334b91d745
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
siscc/sdmxri-nsi-maapi:master6cf1145566f0
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@8.0.30
8.0.32
1
sondresjo/altinnendata-api:v1.8.4401fabc6aa5e
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
sondresjo/bobby-api:latestfe534731909a
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.17
8.0.32
1
sondresjo/garge-api:v2.16.14299b540971b
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
sondresjo/garge-operator:v1.12.1a414ee2a3d5e
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
sondresjo/nstuning-api:v1.7.2ce827dcb8284
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
sondresjo/pyttogpanne-api:v1.0.54789c6031d93
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
technitium/dns-server:15.5.1b8efe03a5e3b
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
technitium/dns-server:15.6.1e5474007d142
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
thiagoguaru/alerthawk.authentication:3.3.11a769f8094271
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
thiagoguaru/alerthawk.finops.api:3.3.185b7d7fb62dc6
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
thiagoguaru/alerthawk.metrics:3.3.159c88dbaef8df
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
thiagoguaru/alerthawk.metrics.api:3.3.154d5905ceaaf6
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
thiagoguaru/alerthawk.notification:3.3.10265884082396
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
thomaszy2077/batch:1a271ab8a80bd
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.8
8.0.32
1
tibyandocker/serviceexample:latesta4ad592cea84
Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.15
9.0.21
1
worthnl/notifynl-omc:2.3.1e4e232b4aab9
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
ghcr.io/alethic/auth0-operator-image:1.4.122468990a8521
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.2
10.0.13
1
ghcr.io/bitwarden/admin:2026.9.2e82f37409cce
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/api:2026.9.272abdfb33c83
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/attachments:2026.9.2a3e09f120b64
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/events:2026.9.2818a1d907fc4
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/icons:2026.9.25e23eaab3976
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/identity:2026.9.263037d60f7d8
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/mssqlmigratorutility:2026.9.263a75561b94c
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/notifications:2026.9.2029f0d8a576f
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/sso:2026.9.23ef058df2039
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/bitwarden/web:2026.9.10d9b5f239cb8
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/chgl/fhir-server-exporter:v3.0.1926f8963a44d4
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
ghcr.io/cleanuparr/cleanuparr:2.10.9cfada3e57214
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
ghcr.io/innago-property-management/innago-vault-k8s-role-operator:2.0.0ed1c3fd04057
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@9.0.11
9.0.21
1
ghcr.io/ivanjosipovic/aks-kargo-analysisrun-logs/aks-kargo-analysisrun-logs:1.1.53c9e63bffb931
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/ivanjosipovic/oidc-guard/oidc-guard:3.8.5080c5777a293e
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.12
10.0.13
1
ghcr.io/justarchinet/archisteamfarm:6.3.10.4af5d4b28ef3a
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
ghcr.io/nmshd/backbone-admin-cli:7.2.3eb959d566216
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/nmshd/backbone-admin-ui:7.2.3462b7b384ee6
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/nmshd/backbone-consumer-api:7.2.3c3af06abdae7
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/nmshd/backbone-database-migrator:7.2.39584941d1977
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/nmshd/backbone-event-handler:7.2.3763550d9b404
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/nmshd/backbone-housekeeper:7.2.38a5e3258fc66
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/nmshd/backbone-identity-deletion-jobs:7.2.3734d28a296d9
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.10
10.0.13
1
ghcr.io/open-telemetry/demo:1.12.0-accountingservice6d051840bb29
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.10
8.0.32
1
ghcr.io/open-telemetry/demo:3.1.0-accountingbfd9d13ac58a
Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12
10.0.13
1
ghcr.io/rogerfar/rdtclient:2.0.1388232cb0ddcf5
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@10.0.0
10.0.13
1
ghcr.io/thoroslives/zilean:v3.10.1bce6aca0f6ca
Microsoft.AspNetCore.App.Runtime.linux-musl-x64@9.0.15
9.0.21
1
ghcr.io/zoriya/kyoo_back:4.7.1416e980f76a6
Microsoft.AspNetCore.App.Runtime.linux-x64@8.0.11
8.0.32
1

syft 1.42.1 · advisories as of 14 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.