Live › vulnerability › CVE-2026-70188
Go to dashboardASP.NET Core's Kestrel HTTP server accepts newline characters in HTTP/2 request trailers and HPACK dynamic-table values instead of rejecting them as malformed, enabling HTTP request smuggling (CWE-444). An unauthenticated remote attacker can use this to desynchronize request handling and gain high confidentiality and integrity impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 |
| 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
dotnet --list-runtimes and dotnet --info to see installed runtime versions; compare the Microsoft.AspNetCore.App.Runtime.* package versions in your projects against the affected ranges11.0.0-preview.1 through 11.0.0-rc.1, 10.0.0 through 10.0.12, 9.0.0 through 9.0.20, or 8.0.0 through 8.0.3111.0.0-rc.2, 10.0.13, 9.0.21, or 8.0.32, and install the latest .NET; recompile and redeploy self-contained apps and restart services after updating8.0.32 as the fix; note the 8.0 range is listed on the affected rows only for linux-arm in the source tableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Kestrel accepts newline characters in HTTP/2 request trailers and values retrieved from the dynamic HPACK table instead of treating them as malformed.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/462
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 |
This page as .md · .json · in your agent: get_signal("CVE-2026-70188")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
| 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0. |