ASP.NET Core Kestrel HTTP Request Smuggling Flaw CVE-2026-88092 Enables Network Tampering via Aborted Connections

Microsoft has released security updates for ASP.NET Core to address a critical HTTP request smuggling vulnerability identified as CVE-2026-88092. This flaw affects versions 8 through 11 of the framework and enables unauthorized attackers to tamper with network traffic by exploiting inconsistent HTTP request interpretation.

What happened

The vulnerability exists within the Microsoft.AspNetCore.Server.Kestrel.Core component, which handles HTTP connections in ASP.NET Core applications. According to the GitHub advisory, an aborted HTTP/1 connection can cause the server to reparse unread request-body bytes as a subsequent request. This behavior creates a request-smuggling or desynchronization path that unauthorized attackers can exploit to perform tampering over a network. The issue is classified under CWE-444, which covers inconsistent interpretation of HTTP requests.

The flaw impacts a wide range of package versions across multiple major releases. For ASP.NET Core 8, versions from 8.0.0 up to 8.0.31 are vulnerable, with patch 8.0.32 providing the fix. In ASP.NET Core 9, versions 9.0.0 through 9.0.20 are affected, and version 9.0.21 resolves the issue. ASP.NET Core 10 users running versions 10.0.0 to 10.0.12 must upgrade to 10.0.13. Additionally, preview and release candidate builds of ASP.NET Core 11, specifically from 11.0.0-preview.1 to 11.0.0-rc.1, are vulnerable, with 11.0.0-rc.2 offering the remediation.

Why it matters

This vulnerability is rated as critical with a CVSS score of 9.4, indicating a severe risk to affected systems. The National Vulnerability Database and Microsoft’s Security Update Guide both highlight the potential for unauthorized network tampering. Because the flaw allows an attacker to manipulate how the server interprets HTTP requests, it can lead to significant security breaches if left unpatched. The issue affects all architectures on Windows, Linux, and macOS platforms, making it a widespread concern for developers using these environments.

The broad impact across multiple versions and platforms underscores the importance of timely patching. Developers must ensure that their applications are updated to the patched versions to mitigate the risk of exploitation. The vulnerability’s presence in preview versions of ASP.NET Core 11 also highlights the need for vigilance even in pre-release software.

What to watch

• Monitor application logs for unusual HTTP request patterns or unexpected connection terminations.
• Check for any anomalies in request-body handling or desynchronization events in your web servers.
• Review network traffic for signs of tampering or unauthorized access attempts.
• Ensure that all ASP.NET Core applications are updated to the latest patched versions.

Signals worth monitoring

Teams usually detect HTTP request smuggling by analyzing access logs for mismatched request and response headers. Look for instances where the server interprets a single client request as multiple distinct transactions. Check whether your web application firewall or intrusion detection system flags unusual HTTP method sequences or content-length discrepancies. First containment moves often involve isolating affected servers and reviewing recent deployment changes. Security operations should also correlate these signals with any unexpected changes in application behavior or performance metrics.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: ASP.NET Core

• Audit your current ASP.NET Core versions against the affected ranges listed in the advisory.
• Apply the patched versions (8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2) to your production environments.
• Verify that all NuGet packages are updated to the latest secure versions.
• Monitor your systems for any signs of exploitation until all patches are confirmed deployed.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which ASP.NET Core versions are affected by CVE-2026-88092?

Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are affected.

What is the CVSS score for this vulnerability?

The CVSS score for CVE-2026-88092 is 9.4, which is classified as critical.

How can developers mitigate this risk?

Developers should update their ASP.NET Core applications to the patched versions provided by Microsoft.