CVE-2026-62899: Microsoft .NET security feature bypass in System.Net.HttpListener

Executive brief

A security vulnerability exists in the Microsoft .NET component used for handling web requests (HttpListener) on Linux and macOS. This flaw could allow an unauthorized attacker to bypass security protections by sending specially crafted web traffic. If exploited, this could lead to unauthorized access to sensitive information or the ability to circumvent intended security controls within the application.

Technical details

A vulnerability classified as HTTP Request/Response Smuggling (CWE-444) exists in the System.Net.HttpListener component of Microsoft .NET when running on Linux and macOS. The root cause is an inconsistent interpretation of HTTP requests, which allows an unauthenticated attacker to bypass security features over the network. Exploitation requires a specific environment configuration (high attack complexity) but can result in a loss of confidentiality. Patches are available in .NET versions 8.0.30, 9.0.19, and 10.0.11. Developers using self-contained deployments must recompile and redeploy their applications to apply the fix.

Affected products

• Microsoft .NET 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10

Timeline

• 2026-08-11: advisory: Advisory published by Microsoft and GitHub
• 2026-08-11: patched

References

• https://github.com/dotnet/runtime/security/advisories/GHSA-r6mh-95jw-g7qg
• https://github.com/dotnet/announcements/issues/427
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62899
• https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-r6mh-95jw-g7qg