Live › vulnerability › CVE-2026-88092
Go to dashboardAn aborted HTTP/1 connection in ASP.NET Core Kestrel can leave unread request-body bytes to be parsed as a new request, enabling request smuggling and desynchronization. An attacker can use this to slip requests past front-end controls or poison responses for other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 |
| nuget |
| >= 8.0.0, <= 8.0.31 |
| 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| microsoft asp.net core | vendor | >= 8.0.0, < 8.0.32 | 8.0.32 |
| microsoft asp.net core | vendor | >= 9.0.0, < 9.0.21 | 9.0.21 |
| microsoft asp.net core | vendor | >= 10.0.0, < 10.0.13 | 10.0.13 |
| microsoft asp.net core | vendor | > 11.0.0 | – |
| microsoft asp.net core | vendor | = 11.0 | – |
| microsoft visual studio 2022 | vendor | >= 17.14.0, < 17.14.42 | 17.14.42 |
| microsoft visual studio 2026 | vendor | >= 18.10.0, < 18.10.4 | 18.10.4 |
List installed runtime versions with dotnet --info, then check the Microsoft.AspNetCore.App.Runtime.* package references in your project files and lock files against the affected ranges (8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1).
8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2, and install the latest .NET runtime on the hostEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An aborted Kestrel HTTP/1 connection can reparse unread request-body bytes as another request, creating a request-smuggling or desynchronization path.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/472
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
This page as .md · .json · in your agent: get_signal("CVE-2026-88092")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0. |