Microsoft Fixes Critical HTTP Request Smuggling Flaw in ASP.NET Core

Microsoft has addressed CVE-2026-88092, a critical security vulnerability in its ASP.NET Core framework. The flaw enables unauthorized attackers to perform tampering over a network by exploiting inconsistent interpretations of HTTP requests. This issue, known as HTTP request or response smuggling, carries a CVSS score of 9.4.

The vulnerability resides in the Microsoft.AspNetCore.Server.Kestrel.Core component. According to the GitHub advisory GHSA-rv87-ccxw-8ggf, an aborted HTTP/1 connection in Kestrel can reparse unread request-body bytes as another request. This behavior creates a request-smuggling or desynchronization path that attackers can leverage to compromise application integrity.

Technical Context and Severity

The National Vulnerability Database rates CVE-2026-88092 as critical with a CVSS 3.1 score of 9.4. The weakness is classified under CWE-444, which covers inconsistent interpretation of HTTP requests. The attack vector is network-based with low complexity, requiring no privileges and no user interaction.

Microsoft’s official advisory confirms that the flaw allows unauthorized remote tampering. The company released this security advisory to inform developers about the risk in Microsoft.AspNetCore.Server.Kestrel.Core. The advisory also provides guidance on updating applications to remove the vulnerability from affected systems.

Affected Versions and Platforms

The vulnerability impacts multiple major versions of ASP.NET Core running on Windows, Linux, and macOS. For version 8, packages from 8.0.0 through 8.0.31 are vulnerable, with 8.0.32 providing the fix. Version 9 is affected from 9.0.0 through 9.0.20, with 9.0.21 serving as the patched release.

Version 10 users must update from versions 10.0.0 through 10.0.12 to 10.0.13. Preview and release candidate versions of ASP.NET Core 11 are also affected. Specifically, versions from 11.0.0-preview.1 through 11.0.0-rc.1 contain the flaw, while 11.0.0-rc.2 resolves it. All architectures, including x64, arm, and arm64, are impacted.

What should you do?

Developers should immediately check their project dependencies for the affected Microsoft.AspNetCore.App.Runtime packages. If any version falls within the vulnerable ranges listed above, an update to the patched version is required. Organizations should prioritize updating production environments that expose ASP.NET Core applications to untrusted networks.