Описание
ASP.NET Core Tampering Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
FAQ
How could an attacker exploit this vulnerability?
An unauthenticated attacker could send specially crafted HTTP/1.1 requests through a reverse proxy to an affected server. Successful exploitation could desynchronize request handling between the proxy and the server, allowing the attacker to inject an unintended request. User interaction is not required.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| ASP.NET Core 8.0 | ||
| ASP.NET Core 9.0 | ||
| Microsoft Visual Studio 2022 version 17.14 | ||
| ASP.NET Core 10.0 | ||
| ASP.NET Core 11.0 | ||
| Microsoft Visual Studio 2026 version 18.10 |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
EPSS
9.4 Critical
CVSS3
Связанные уязвимости
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability
EPSS
9.4 Critical
CVSS3