CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling

CVE-2026-88092 · Severity: critical · CVSS 9.4 · Published 2026-10-13

ASP.NET Core's Kestrel web server can allow an attacker to inject or smuggle HTTP requests by exploiting how aborted connections handle unread request bodies. This allows bypassing security controls and potentially accessing unauthorized data or performing unauthorized actions on vulnerable web applications.

Technologies: Microsoft Asp.Net Core, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet), Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet), Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet), Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet), Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet), Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet), Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet), Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-88092 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88092 being exploited in the wild.
How severe is CVE-2026-88092?
Critical severity, with a CVSS score of 9.4, published 13 October 2026.
Which products and versions are affected?
Microsoft Asp.Net Core 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; and 8 more.
Is there a fix for CVE-2026-88092?
Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88092 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-88092?
Check whether you run Microsoft Asp.Net Core, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 8.0.32
  • Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 8.0.32

Technical details

The vulnerability exists in Microsoft.AspNetCore.Server.Kestrel.Core where unread request-body bytes from an aborted HTTP/1 connection can be reinterpreted as a separate request, leading to HTTP request smuggling (CWE-444). The attack requires network access to send a crafted HTTP/1 request; no authentication or user interaction is needed. An attacker can bypass request filtering, access control checks, or inject malicious requests that the application processes.

Affected products

  • Microsoft ASP.NET Core 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1

Identifiers

  • CVE-2026-88092
  • GHSA-rv87-ccxw-8ggf

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.