CVE-2026-88092

Summary

This CVE describes an HTTP request smuggling vulnerability in ASP.NET Core where inconsistent interpretation of HTTP requests allows attackers to manipulate how requests are processed, potentially leading to unauthorized data access or modification. The flaw occurs due to improper handling of HTTP request/response parsing that can cause servers to interpret the same request differently, enabling attackers to smuggle requests through the system.

Exploitability

Exploitation requires understanding HTTP smuggling techniques and crafting specific malformed requests that exploit the inconsistent parsing behavior, but the attack surface is relatively broad since it affects all ASP.NET Core applications handling HTTP traffic.

Blast radius

If exploited, this vulnerability could allow attackers to perform unauthorized data tampering or access sensitive information across affected ASP.NET Core applications, potentially affecting multiple users and systems depending on the application's scope.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to .NET 8.0.10 or later, which contains the fix for this HTTP request smuggling vulnerability in ASP.NET Core.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.