Microsoft patches Kestrel HTTP smuggling flaw CVE-2026-88092 for ASP.NET Core 8-11 on all platforms

Microsoft has released updates to address a critical HTTP request smuggling vulnerability in ASP.NET Core. The fix applies to versions 8 through 11 of the framework across Windows, Linux, and macOS platforms.

What happened

Microsoft’s Security Update Guide identifies CVE-2026-88092 as a tampering vulnerability within ASP.NET Core. The flaw stems from inconsistent interpretation of HTTP requests, allowing unauthorized network tampering. The National Vulnerability Database assigns the issue a CVSS score of 9.4, classifying it as critical. The underlying weakness is categorized as CWE-444.

The vulnerability specifically impacts the Microsoft.AspNetCore.Server.Kestrel.Core package. According to GitHub advisory GHSA-rv87-ccxw-8ggf, an aborted Kestrel HTTP/1 connection can reparse unread request-body bytes as another request. This behavior creates a request-smuggling or desynchronization path that attackers can exploit. The issue affects all architectures on Windows, Linux, and macOS.

Why it matters

The vulnerability affects a wide range of ASP.NET Core versions currently in use. Versions 8.0.0 through 8.0.31 are vulnerable, with version 8.0.32 providing the patch. Versions 9.0.0 through 9.0.20 are also affected, with version 9.0.21 serving as the fix. For version 10, releases from 10.0.0 to 10.0.12 are vulnerable, and 10.0.13 resolves the issue.

Version 11 preview and release candidate builds up to 11.0.0-rc.1 are impacted, with 11.0.0-rc.2 offering the mitigation. The flaw exists in runtime packages for linux-arm, linux-arm64, linux-musl-arm, linux-musl-arm64, linux-musl-x64, linux-x64, osx-arm64, osx-x64, win-arm64, win-x64, and win-x86. This broad scope means many enterprise applications may be exposed if they have not updated their NuGet packages recently.

What to watch

• Monitor internal logs for signs of HTTP request desynchronization or unusual traffic patterns.
• Verify that all ASP.NET Core applications are running the patched runtime versions listed in the advisory.
• Check for any unauthorized changes to network request handling or data integrity issues.
• Ensure development environments are not using vulnerable preview or release candidate builds.

Who needs to act first

Teams should prioritize updating systems that face direct internet exposure. Public-facing web applications using Kestrel as the front-end server require immediate attention. Organizations should test the patched versions in non-production environments before rolling them out widely. It is advisable to back up current configurations and application data prior to applying updates. If a system cannot be updated immediately, teams should consider placing it behind a reverse proxy or web application firewall that can inspect and normalize HTTP traffic. This helps mitigate the risk of request smuggling attempts while a permanent fix is deployed.

What to do and how to stay safe: Microsoft

• Inventory all servers running ASP.NET Core versions 8, 9, 10, and 11 to identify affected instances.
• Update NuGet packages to the specific patched versions listed in the Microsoft advisory.
• Restart application services to ensure the new runtime versions are actively loaded.
• Validate that HTTP request handling behaves correctly after the update is applied.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific component is vulnerable to CVE-2026-88092?

The vulnerability exists in the Microsoft.AspNetCore.Server.Kestrel.Core package within ASP.NET Core.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-88092 as critical with a CVSS score of 9.4.

Are preview versions of ASP.NET Core 11 affected?

Yes, versions from 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable, with 11.0.0-rc.2 providing the fix.