CVE-2026-88092

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.linux-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.osx-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-arm versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.osx-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-arm versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.App.Runtime.linux-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.osx-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.win-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.win-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.win-x86 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.App.Runtime.linux-arm versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.linux-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.osx-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-arm versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.20

Description Inconsistent interpretation of HTTP requests in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. Specifically, an aborted Kestrel HTTP/1 connection can reparse unread request-body bytes as another request, creating a request-smuggling or desynchronization path. Request smuggling is a technique where an attacker interferes with the way a website and its reverse proxy process HTTP requests.

Recommendations Update Microsoft.AspNetCore.App.Runtime.linux-arm versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.linux-x64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.osx-x64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.win-arm versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.win-arm64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.win-x64 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.win-x86 versions 8.0.0 through 8.0.31 to version 8.0.32 Update Microsoft.AspNetCore.App.Runtime.linux-arm versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.linux-x64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.osx-x64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.win-arm versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.win-arm64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.win-x64 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.win-x86 versions 10.0.0 through 10.0.12 to version 10.0.13 Update Microsoft.AspNetCore.App.Runtime.linux-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.linux-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.osx-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.win-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.win-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.win-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.win-x86 versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2 Update Microsoft.AspNetCore.App.Runtime.linux-arm versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.linux-musl-x64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.linux-x64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.osx-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.osx-x64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.win-arm versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.win-arm64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.win-x64 versions 9.0.0 through 9.0.20 to version 9.0.21 Update Microsoft.AspNetCore.App.Runtime.win-x86 versions 9.0.0 through 9.0.20 to version 9.0.21