ASP.NET Core HTTP Request Smuggling Vulnerability by Microsoft
CVE-2026-70188

9.1CRITICAL

Key Information:

Vendor

Microsoft
Status
Asp.net Core 10.0
Asp.net Core 11.0
Asp.net Core 8.0
Asp.net Core 9.0
Vendor
CVE Published:
13 October 2026

What is CVE-2026-70188?

The vulnerability in ASP.NET Core arises from an inconsistent interpretation of HTTP requests, known as HTTP request smuggling. This can allow an unauthorized attacker to circumvent security features, potentially compromising the integrity of communications and data security over a network. It is crucial for organizations using affected versions to assess their risk and apply necessary patches to mitigate the vulnerability.

Affected Version(s)

ASP.NET Core 10.0 10.0 < 10.0.13

ASP.NET Core 11.0 11.0 < 11.0.0-rc.2

ASP.NET Core 8.0 8.0 < 8.0.32

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.