Organisations urged to patch ASP.NET Core 8-11 against critical 9.4-score network tampering flaw

Microsoft has published security updates for ASP.NET Core to address a critical vulnerability that permits unauthorised network tampering. The flaw, identified as CVE-2026-88092, stems from inconsistent interpretation of HTTP requests within the framework’s Kestrel server component. This issue allows attackers to smuggle requests, potentially bypassing security controls or manipulating data flows.

The vulnerability affects multiple major versions of the framework across all supported operating systems. According to GitHub advisory GHSA-rv87-ccxw-8ggf, the flaw exists in Microsoft.AspNetCore.App.Runtime packages for Windows, Linux and macOS. Developers using affected versions must update their applications to remove the risk. The National Vulnerability Database assigns the flaw a CVSS score of 9.4, classifying it as critical.

What we know

The Microsoft Security Update Guide describes the issue as HTTP request/response smuggling caused by inconsistent interpretation of HTTP requests. This weakness, mapped to CWE-444, enables an unauthorised attacker to perform tampering over a network. The technical root cause involves an aborted Kestrel HTTP/1 connection reparsing unread request-body bytes as another request. This creates a desynchronisation path that attackers can exploit.

Affected versions include ASP.NET Core 8.0.0 through 8.0.31, which are patched in version 8.0.32. Version 9.0.0 through 9.0.20 is fixed in 9.0.21. Version 10.0.0 through 10.0.12 is resolved in 10.0.13. Preview and release candidate versions of ASP.NET Core 11, from 11.0.0-preview.1 through 11.0.0-rc.1, are patched in 11.0.0-rc.2.

Defender's checklist

• Verify current ASP.NET Core runtime versions against the vulnerable ranges listed in the GitHub advisory.
• Identify all servers running Windows, Linux or macOS that host affected Microsoft.AspNetCore.App.Runtime packages.
• Prioritise patching systems exposed to the internet, as the vulnerability allows remote network tampering.
• Monitor application logs for signs of HTTP desynchronisation or unusual request patterns following an update.

The background in plain language

HTTP request smuggling occurs when different parts of a web server interpret the same data stream differently. This confusion can allow an attacker to hide malicious requests inside seemingly normal traffic. Teams usually check whether their web servers handle request boundaries consistently. Developers should ensure that application frameworks parse HTTP headers and bodies in a single, agreed-upon way to prevent desynchronisation attacks.

What to do and how to stay safe: Microsoft

• Check your project dependencies for Microsoft.AspNetCore.App.Runtime packages matching the vulnerable version ranges.
• Apply the latest patch versions provided by Microsoft, such as 8.0.32 or 11.0.0-rc.2, to your applications.
• Review network traffic logs for anomalies that might indicate successful request smuggling attempts.
• Ensure all environments, including development and staging, are updated to prevent accidental exposure.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which operating systems are affected by CVE-2026-88092?

The vulnerability affects ASP.NET Core applications running on Windows, Linux and macOS across all hardware architectures.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-88092 as critical with a CVSS score of 9.4.

Are preview versions of ASP.NET Core 11 affected?

Yes, versions from 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable and should be updated to 11.0.0-rc.2.