Description
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Published: 2026-10-13
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rv87-ccxw-8ggf Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability
History

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Critical

Fri, 16 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft visual Studio 2026
CPEs cpe:2.3:a:microsoft:asp.net_core:11.0:rc1:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*
Vendors & Products Microsoft visual Studio 2026

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Title ASP.NET Core Tampering Vulnerability
First Time appeared Microsoft
Microsoft asp.net Core
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft visual Studio 2022
Weaknesses CWE-444
CPEs cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft asp.net Core
Microsoft microsoft Visual Studio 2026 Version 18.10
Microsoft visual Studio 2022
References
Metrics cvssV3_1

{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022 Visual Studio 2026
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-16T23:24:17.417Z

Reserved: 2026-09-09T21:47:30.203Z

Link: CVE-2026-88092

cve-icon Vulnrichment

Updated: 2026-10-13T19:58:34.351Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:21:27.043

Modified: 2026-10-16T15:47:14.833

Link: CVE-2026-88092

cve-icon Redhat

Severity : Critical

Publid Date: 2026-10-13T17:00:00Z

Links: CVE-2026-88092 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T10:00:07Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')