Microsoft ASP.NET Core: HTTP request smuggling in Kestrel
Summary
ASP.NET Core's Kestrel web server can reparse unread request body bytes of an aborted HTTP/1 connection as a new request. A remote, unauthenticated attacker can use this to smuggle requests, tamper with traffic and potentially bypass proxy or WAF filters. Applications served by Kestrel over HTTP/1.1, particularly internet-facing apps and apps behind reverse proxies, are most at risk.
Affected
- Microsoft ASP.NET Core 8.0: versions 8.0 to before 8.0.32
- Microsoft ASP.NET Core 9.0: versions 9.0 to before 9.0.21
- Microsoft ASP.NET Core 10.0: versions 10.0 to before 10.0.13
- Microsoft ASP.NET Core 11.0: versions 11.0 to before 11.0.0-rc.2
- Microsoft Visual Studio 2022 version 17.14: versions 17.14.0 to before 17.14.42
- Microsoft Visual Studio 2026 version 18.10: versions 18.10.0 to before 18.10.4
- .NET 6: not assessed by Microsoft; a third-party vendor reports it is also affected (unverified)
Fixed in
- ASP.NET Core 8.0.32
- ASP.NET Core 9.0.21
- ASP.NET Core 10.0.13
- ASP.NET Core 11.0.0-rc.2
- Visual Studio 2022 17.14.42
- Visual Studio 2026 18.10.4
- Full patched list: see the Microsoft Security Update Guide (not fully verified)
Workaround
Unknown. No vendor-documented workaround is available. Red Hat states that no mitigation meets its criteria. Filtering at a reverse proxy or WAF is not a fix.
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact total
- Not listed in the CISA KEV catalog
- No public proof of concept or in-the-wild exploitation found in our research; this does not rule out that one exists
Our recommendation
- Inventory all .NET runtimes on servers, containers and cloud app services, including the installed host runtime, not only SDKs or project references
- Patch to the fixed versions listed in the Microsoft advisory and verify the installed runtime after deployment
- Prioritise internet-facing and reverse-proxy-fronted .NET applications
- Plan migration away from out-of-support versions such as .NET 6, or evaluate a paid extended-support option
- Do not rely on proxies or WAFs as the only defence
- Monitor the Microsoft advisory and CISA KEV for changes
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-88092 msrc.microsoft.com
- Microsoft advisory mirror (dotnet announcements) github.com
- GitHub Security Advisory GHSA-5rrx-jjjq-q2r5 github.com
- Red Hat CVE page access.redhat.com
- Red Hat Bugzilla entry bugzilla.redhat.com
- OpenCVE (CISA SSVC data) app.opencve.io
- HeroDevs blog (third-party, .NET 6) www.herodevs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:04.
Original description (NVD)
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.