MSRC-CVE-2026-88092 — ASP.NET Core Tampering Vulnerability

Summary

Impact: Tampering. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An unauthenticated attacker could send specially crafted HTTP/1.1 requests through a reverse proxy to an affected server. Successful exploitation could desynchronize request handling between the proxy and the server, allowing the attacker to inject an unintended request. User interaction is not required.

Security updates
18.10.4 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
17.14.42 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
8.0.32 — https://support.microsoft.com/help/5130034
10.0.13 — https://support.microsoft.com/help/5130036
11.0.0-rc.2 — https://github.com/dotnet/announcements/issues/472
9.0.21 — https://support.microsoft.com/help/5130035

Vulnerabilities 1

Critical 9.4

CVE-2026-88092

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 ASP.NET Core 8.0 Ubuntu Alpine Wolfi NuGet

Oct 13, 2026

Revision history

2026-10-13 #1
Information published.

References

CVE-2026-88092 ASP.NET Core Tampering Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss