Apply Microsoft patches for ASP.NET Core 8-11 to stop HTTP request smuggling across Windows, Linux, and macOS

Microsoft has released security updates for ASP.NET Core to address a critical vulnerability that enables unauthorized network tampering. The flaw, identified as CVE-2026-88092, stems from inconsistent interpretation of HTTP requests, a technique known as HTTP request smuggling. According to the National Vulnerability Database, the issue carries a CVSS score of 9.4, rating it as critical severity.

The vulnerability exists within the Microsoft.AspNetCore.Server.Kestrel.Core component. An attacker can exploit this weakness by sending malformed HTTP requests that the server interprets differently than intended. This desynchronization allows the unauthorized party to perform tampering over the network without prior authentication. The flaw affects multiple runtime packages across various operating systems and architectures.

Affected versions and patches

Microsoft has provided patched versions for ASP.NET Core 8, 9, 10, and 11. For version 8, users must upgrade to 8.0.32 or later. Version 9 requires an update to 9.0.21 or later. Version 10 users should move to 10.0.13 or later. Those using version 11 preview builds must upgrade to 11.0.0-rc.2 or later. The vulnerability affects all versions prior to these patched releases.

The issue spans Windows, Linux, and macOS platforms. It impacts runtime packages for x64, x86, ARM, and ARM64 architectures. This includes standard Linux distributions as well as Linux-musl variants. macOS users on both Intel and Apple Silicon chips are also affected. Windows users on x64, x86, and ARM64 systems face the same exposure.

What to watch

Organizations should verify their current ASP.NET Core versions against the patched list provided by Microsoft. Developers should test application updates in staging environments before deploying to production servers. Monitor network traffic for unusual HTTP request patterns that might indicate exploitation attempts. Check dependency trees in project files to ensure all transitive dependencies are updated to secure versions.

What made it possible

HTTP request smuggling occurs when different layers of a web infrastructure interpret request boundaries inconsistently. Attackers exploit this discrepancy by crafting messages that one component reads as a single request while another reads as two. This desynchronization allows the attacker to inject malicious data into subsequent requests or bypass security controls. Teams usually mitigate this by ensuring strict parsing rules and consistent header handling across all network layers.

What to do and how to stay safe: Microsoft

• Audit all web applications to identify which versions of ASP.NET Core are currently in use.
• Apply the available security updates to move to the patched versions listed in the advisory.
• Review server logs for signs of abnormal HTTP traffic or unexpected request responses.
• Ensure that all dependencies in the application build chain are updated to secure versions.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-88092?

The National Vulnerability Database assigns a CVSS score of 9.4 to this vulnerability, classifying it as critical.

Which operating systems are affected by this flaw?

The vulnerability affects applications running on Windows, Linux, and macOS across all supported processor architectures.

Is there a patch available for ASP.NET Core 8?

Yes, Microsoft has released version 8.0.32 as the patched version for ASP.NET Core 8 to address this issue.