{"id":"CVE-2026-88092","published":"2026-10-13T19:21:27.043","lastModified":"2026-10-16T15:47:14.833","description":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwes":["CWE-444"],"vendors":["microsoft"],"products":["asp.net core","visual studio 2022","visual studio 2026"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes an HTTP request smuggling vulnerability in ASP.NET Core where inconsistent interpretation of HTTP requests allows attackers to manipulate how requests are processed, potentially leading to unauthorized data access or modification. The flaw occurs due to improper handling of HTTP request/response parsing that can cause servers to interpret the same request differently, enabling attackers to smuggle requests through the system.","exploitability":"Exploitation requires understanding HTTP smuggling techniques and crafting specific malformed requests that exploit the inconsistent parsing behavior, but the attack surface is relatively broad since it affects all ASP.NET Core applications handling HTTP traffic.","blast_radius":"If exploited, this vulnerability could allow attackers to perform unauthorized data tampering or access sensitive information across affected ASP.NET Core applications, potentially affecting multiple users and systems depending on the application's scope.","remediation":"Upgrade to .NET 8.0.10 or later, which contains the fix for this HTTP request smuggling vulnerability in ASP.NET Core.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","http","request-smuggling","aspnet-core"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:54:46.787Z"}}