Microsoft patches critical HTTP smuggling flaw in ASP.NET Core Kestrel
A critical vulnerability in ASP.NET Core allows attackers to bypass security features. Microsoft has released updates for versions 8 through 11 to address the issue.
Key points
- CVE-2026-70188 is rated critical with a CVSS score of 9.1.
- The flaw allows unauthorized network bypass of security features via HTTP request smuggling.
- Patches are available for ASP.NET Core versions 8, 9, 10, and 11 across all platforms.
Microsoft has released security updates to fix a critical vulnerability in ASP.NET Core that allows attackers to bypass security features. The flaw, identified as CVE-2026-70188, stems from inconsistent interpretation of HTTP requests within the Kestrel web server.
At a glance
- Advisory
- GHSA-fpq8-4vhr-rcxx
- CVE
- CVE-2026-70188
- Package
- Microsoft.AspNetCore.App.Runtime.linux-arm (nuget)
- Severity
- Critical
- Patched in
- 11.0.0-rc.2
The National Vulnerability Database rates the issue as critical with a CVSS score of 9.1. An unauthorized attacker can exploit this weakness over a network to circumvent security controls. The vulnerability is classified under CWE-444, which covers inconsistent interpretation of HTTP requests.
Technical details of the flaw
Microsoft describes the issue as HTTP request or response smuggling. The Kestrel server incorrectly handles newline characters in HTTP/2 request trailers. It also fails to properly validate values retrieved from the dynamic HPACK table.
Instead of treating these inputs as malformed, the server accepts them. This behavior allows an attacker to manipulate how the server interprets incoming requests. The flaw exists in the Microsoft.AspNetCore.Server.Kestrel.Core component.
Affected versions and platforms
The vulnerability affects multiple versions of the Microsoft.AspNetCore.App.Runtime packages. Versions 8.0.0 through 8.0.31 are vulnerable, with 8.0.32 providing the fix. Versions 9.0.0 through 9.0.20 are affected, patched in 9.0.21.
ASP.NET Core 10 users should update from 10.0.0 through 10.0.12 to 10.0.13. For version 11, builds from 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable. The patched version is 11.0.0-rc.2.
The issue impacts applications running on Windows, Linux, and macOS. It affects all supported architectures, including x64, x86, ARM, and ARM64. Both standard and musl-based Linux runtimes are included in the affected package list.
What should you do?
Developers should immediately check their project dependencies for affected versions of Microsoft.AspNetCore.App.Runtime. Updating to the patched versions listed in the advisory removes the vulnerability. Organizations should monitor their networks for unusual HTTP traffic patterns.
What to do and how to stay safe: Microsoft
- Audit your NuGet packages to identify if you are using vulnerable versions of Microsoft.AspNetCore.App.Runtime.
- Update your applications to the patched versions specified in the Microsoft advisory as soon as possible.
- Monitor server logs for signs of HTTP request smuggling or abnormal request patterns.
- Review your network security rules to ensure external traffic is properly inspected before reaching the server.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-70188?
It is a critical vulnerability in ASP.NET Core that allows HTTP request smuggling and security feature bypass.
Which versions of ASP.NET Core are affected?
Versions 8, 9, 10, and early preview/RC builds of 11 are affected across all platforms.
Is there a patch available?
Yes, Microsoft has released patched versions for all affected lines, including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.
