CVE-2026-88092

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A request smuggling vulnerability (CVE-2026-88092) has been identified in ASP.NET Core's Kestrel web server. When an HTTP/1.1 connection is aborted before Kestrel has read the whole request body, Kestrel can treat the unread body bytes as a new request and pass it to the application.

Per CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), the weakness is a product that acts as an intermediary or endpoint and does not interpret malformed or ambiguous HTTP requests consistently with how other parties interpret them, letting an attacker smuggle a request past them.

This issue affects every ASP.NET Core 6.0 application served by Kestrel over HTTP/1.1, which is the default, on Windows, Linux, and macOS. No special configuration is needed to be exposed. Microsoft's advisory lists ASP.NET Core 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that 6.0 carries the same code path.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application served by Kestrel at version 6.0.46 or earlier.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App), in-box code from Microsoft.AspNetCore.Server.Kestrel.Core
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This Critical-severity vulnerability is found in the HTTP/1.1 request loop of Kestrel, in the ASP.NET Core shared framework.

After each request, Kestrel normally reads and discards any part of the request body the application did not consume, so the next request on a keep-alive connection starts at the right byte. When the connection was aborted while body bytes were still unread, Kestrel skipped that drain step but left the connection marked as keep-alive. The request loop then went round again and parsed the unread body bytes as if they were the start of the next request. A client could therefore place a complete second request inside a request body and have it dispatched to the application, outside whatever checks a proxy or front end applied to the outer request.

The fix turns keep-alive off at the moment the connection abort is recorded, so the request loop stops whenever the drain is skipped for that reason. This matches Microsoft's own servicing change for the supported ASP.NET Core releases.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

thegoldmandm, as credited in Microsoft's advisory.