How a Missing CancellationToken in ASP.NET Core Caused Thread Pool Exhaustion Under Load

A .NET developer discovered a subtle but serious bug while reviewing an ASP.NET Core codebase that was showing mysterious latency spikes and sluggish performance under high traffic. The application used a fire-and-forget pattern, returning a 202 Accepted response immediately while offloading heavy work to a background task without passing a CancellationToken. When traffic peaked at around 1,000 requests per second, up to 1,000 concurrent background tasks were hitting a slow third-party API, saturating the default HttpClient connection pool. Because no cancellation context was propagated, background tasks continued running even after clients disconnected, and subsequent CPU-bound work queued up until the thread pool hit its maximum limit. The fix involved passing a CancellationToken into the background task and adding explicit checks within the work loop so the operation could be cancelled when no longer needed.