Microsoft ASP.NET Core: Security feature bypass via HTTP request smuggling
Summary
A security feature bypass in the Kestrel web server built into ASP.NET Core allows an unauthenticated remote attacker to bypass a security control over the network. Microsoft describes the flaw as Kestrel accepting line-break characters in HTTP/2 trailers and HPACK dynamic table values instead of rejecting them as malformed, which is classified as HTTP request smuggling (CWE-444). No privileges or user interaction are required, and the CVSS 3.1 base score is 9.1 (Critical). According to the official record, confidentiality and integrity impact is high and availability impact is none.
Affected
- Microsoft ASP.NET Core 8.0: 8.0 to before 8.0.32 - Microsoft ASP.NET Core 9.0: 9.0 to before 9.0.21 - Microsoft ASP.NET Core 10.0: 10.0 to before 10.0.13 - Microsoft ASP.NET Core 11.0: 11.0.0-preview.1 to before 11.0.0-rc.2 - Microsoft Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.42 - Microsoft Visual Studio 2026 version 18.10: 18.10.0 to before 18.10.4 - .NET 6 (end of life): not assessed by Microsoft; a third-party source reports 6.0.0 to 6.0.46 as affected
Fixed in
- ASP.NET Core 8.0.32 - ASP.NET Core 9.0.21 - ASP.NET Core 10.0.13 - ASP.NET Core 11.0.0-rc.2 - Visual Studio 2022 17.14.42 - Visual Studio 2026 18.10.4 - .NET 6: third-party fix in NES release 6.0.47 (not available from Microsoft)
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total. - No active exploitation known as of the research date.
Our recommendation
- Inventory all systems running ASP.NET Core or Visual Studio and identify affected versions. - Install the fixed versions listed above, preferably the latest .NET release. - For .NET 6, which is end of life, plan a migration or obtain a third-party fix. - Review reverse proxies and applications that forward HTTP/2 header values to HTTP/1.1 backends. - Monitor web server logs for anomalous requests.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-70188 msrc.microsoft.com
- Microsoft .NET GitHub discussion on CVE-2026-70188 github.com
- GitHub Security Advisory GHSA-5rrx-jjjq-q2r5 github.com
- GitLab advisory mirror CVE-2026-70188 advisories.gitlab.com
- Red Hat CVE page CVE-2026-70188 access.redhat.com
- HeroDevs vulnerability directory CVE-2026-70188 www.herodevs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:45.
Original description (NVD)
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.