What critical HTTP request smuggling threat faces ASP.NET Core 8-11 users today?

Microsoft has released patches for a critical security flaw in ASP.NET Core that allows attackers to tamper with network requests. The vulnerability, identified as CVE-2026-88092, stems from how the framework interprets HTTP traffic. According to the National Vulnerability Database, the issue carries a CVSS score of 9.4, marking it as Critical. The flaw affects applications running on Windows, Linux, and macOS platforms.

Root cause

The underlying issue lies within Microsoft.AspNetCore.Server.Kestrel.Core, the web server library used by ASP.NET Core. According to the GitHub advisory, an aborted HTTP/1 connection can cause the server to reparse unread request-body bytes as a new request. This behavior creates a desynchronization path between the client and the server. The weakness is classified as CWE-444, which covers inconsistent interpretation of HTTP requests. This mechanism allows for what is known as HTTP request smuggling.

Attack path

An unauthorized attacker can exploit this flaw over a network to perform tampering. By sending crafted requests that trigger the reparsing behavior, the attacker can desynchronize the server's understanding of the request stream. This desynchronization opens a path for request smuggling, potentially allowing the attacker to interfere with how the server processes subsequent requests. The advisory notes that the vulnerability allows tampering, which can compromise the integrity of the application's data handling.

Affected versions

The vulnerability impacts multiple versions of the Microsoft.AspNetCore.App.Runtime packages. For ASP.NET Core 8, versions 8.0.0 through 8.0.31 are vulnerable, with 8.0.32 providing the fix. ASP.NET Core 9 versions 9.0.0 through 9.0.20 are affected, patched in 9.0.21. ASP.NET Core 10 versions 10.0.0 through 10.0.12 are vulnerable, fixed in 10.0.13. ASP.NET Core 11 preview versions up to 11.0.0-rc.1 are affected, patched in 11.0.0-rc.2. All architectures are affected.

Mitigation

• Update ASP.NET Core 8 applications to version 8.0.32 or later
• Update ASP.NET Core 9 applications to version 9.0.21 or later
• Update ASP.NET Core 10 applications to version 10.0.13 or later
• Update ASP.NET Core 11 applications to version 11.0.0-rc.2 or later

What it means for organisations

Teams usually need to verify which runtime versions are deployed in production environments. Check whether internal services or supplier-facing applications use affected ASP.NET Core versions. Notify development leads and infrastructure managers about the need for immediate patching. Review dependency management processes to ensure future updates are applied promptly. Coordinate with vendors to confirm their services are not running vulnerable versions. Establish a timeline for testing and deploying patches in non-production environments first.

What to do and how to stay safe: Microsoft

• Audit your applications to identify if they use Microsoft.AspNetCore.App.Runtime packages
• Check your package manager logs to see if you are running versions below the patched thresholds
• Plan a maintenance window to apply the updates once the vendor provides an update
• Monitor network traffic for signs of request smuggling or desynchronization attempts

Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-88092?

The CVSS 3.1 score is 9.4, which is rated as Critical severity.

Which operating systems are affected by this vulnerability?

The vulnerability affects applications running on Windows, Linux, and macOS platforms.

Is there a fix available for ASP.NET Core 8?

Yes, Microsoft has released version 8.0.32 which patches the vulnerability.