{"id":"CVE-2026-70188","published":"2026-10-13T19:19:33.130","lastModified":"2026-10-14T04:18:33.003","description":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70188","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to manipulate HTTP requests in ASP.NET Core applications, potentially bypassing security controls like authentication and authorization by exploiting inconsistent request parsing behavior. This creates a critical risk where unauthorized users can access protected resources without proper credentials.","exploitability":"Exploitation requires crafting specific HTTP smuggling payloads that exploit the inconsistent interpretation of requests, but attackers can likely achieve this with standard web application attack tools and knowledge of HTTP protocols.","blast_radius":"If exploited, this vulnerability could allow attackers to bypass authentication and authorization controls across affected ASP.NET Core applications, potentially leading to unauthorized access to sensitive data and functionality.","remediation":"Upgrade to .NET 8.0.10 or later, which contains the fix for this HTTP request smuggling vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","http","auth-bypass","aspnet-core"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:56:40.736Z"}}