CVE-2026-88092

Опубликовано: 13 окт. 2026

Источник: redhat

CVSS3: 9.4

Описание

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Отчет

Red Hat has evaluated this vulnerability as having a Critical impact because it allows remote, unauthenticated attackers to execute HTTP request smuggling attacks without requiring user interaction or specialized privileges. ASP.NET Core web applications deployed across Red Hat platforms using Kestrel to process HTTP/1 requests are susceptible if aborted connections lead to desynchronized request boundaries. Exploitation of this desynchronization can result in severe integrity and confidentiality impacts, such as request tampering, credential exposure, or proxy filter evasion.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat Hardened Images	dotnet10.0	Not affected
Red Hat Hardened Images	dotnet8.0	Not affected
Red Hat Hardened Images	dotnet9.0	Not affected
Red Hat Enterprise Linux 10	dotnet8.0	Fixed	RHSA-2026:86168	20.10.2026
Red Hat Enterprise Linux 10	dotnet9.0	Fixed	RHSA-2026:86172	20.10.2026
Red Hat Enterprise Linux 10	dotnet10.0	Fixed	RHSA-2026:86195	20.10.2026
Red Hat Enterprise Linux 10.0 Extended Update Support	dotnet9.0	Fixed	RHSA-2026:88424	22.10.2026
Red Hat Enterprise Linux 10.0 Extended Update Support	dotnet8.0	Fixed	RHSA-2026:88474	22.10.2026
Red Hat Enterprise Linux 8	dotnet9.0	Fixed	RHSA-2026:86170	20.10.2026
Red Hat Enterprise Linux 8	dotnet10.0	Fixed	RHSA-2026:86192	20.10.2026

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Critical

Дефект:

CWE-444

https://bugzilla.redhat.com/show_bug.cgi?id=2548799dotnet: ASP.NET Core Tampering Vulnerability

9.4 Critical

CVSS3

Связанные уязвимости

CVE-2026-88092

CVSS3: 9.4

ubuntu

14 дней назад

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVE-2026-88092

CVSS3: 9.4

nvd

13 дней назад

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.