Summary
Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability
Advisory details
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Kestrel accepts newline characters in HTTP/2 request trailers and values retrieved from the dynamic HPACK table instead of treating them as malformed.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/462
CVSS Details
- Version: 3.1
- Severity: Critical
- Score: 9.1
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
Affected Platforms
- Platforms: Windows, Linux, macOS
- Architectures: All
Affected Packages
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
References
Related vulnerabilities
All Supply chain →- CRITICALCVE-2026-88092
Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability
- MEDIUMCVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
- MEDIUMCVE-2026-69216
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
- HIGHCVE-2026-69205
Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
- CRITICALCVE-2026-69204
Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
- HIGHCVE-2026-88008
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization