CVE-2026-70188

Summary

This vulnerability allows attackers to manipulate HTTP requests in ASP.NET Core applications, potentially bypassing security controls like authentication and authorization by exploiting inconsistent request parsing behavior. This creates a critical risk where unauthorized users can access protected resources without proper credentials.

Exploitability

Exploitation requires crafting specific HTTP smuggling payloads that exploit the inconsistent interpretation of requests, but attackers can likely achieve this with standard web application attack tools and knowledge of HTTP protocols.

Blast radius

If exploited, this vulnerability could allow attackers to bypass authentication and authorization controls across affected ASP.NET Core applications, potentially leading to unauthorized access to sensitive data and functionality.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to .NET 8.0.10 or later, which contains the fix for this HTTP request smuggling vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.