CVE-2026-88092: ASP.NET Core Tampering Vulnerability

Overview

Severity

Critical (CVSS 9.4)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C

Category

Tampering

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

FAQ

How could an attacker exploit this vulnerability? An unauthenticated attacker could send specially crafted HTTP/1.1 requests through a reverse proxy to an affected server. Successful exploitation could desynchronize request handling between the proxy and the server, allowing the attacker to inject an unintended request. User interaction is not required.

Affected Products (6)

Developer Tools

• Microsoft Visual Studio 2026 version 18.10
• Microsoft Visual Studio 2022 version 17.14
• ASP.NET Core 8.0
• ASP.NET Core 10.0
• ASP.NET Core 11.0
• ASP.NET Core 9.0

Security Updates (4)

• 5130034
• 5130036
• Release Notes
• 5130035

Acknowledgments

thegoldmandm

Revision History

• 2026-10-13: Information published.