CVE-2026-88092 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2026-88092

CVE-2026-88092

Published:October 13, 2026

Updated:October 15, 2026

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Affected Packages

microsoft.aspnetcore.app.runtime.linux-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-x86 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-arm (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-arm (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.osx-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.osx-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.osx-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.osx-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-arm (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-x64 (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-arm64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-arm (DOT_NET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.osx-arm64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-x64 (DOT_NET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-musl-x64 (DOT_NET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=6.0.0 <6.0.47

Fix Suggestion:

Update to version 6.0.47

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.21

Fix Suggestion:

Update to version 9.0.21

microsoft.aspnetcore.app.runtime.win-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

microsoft.aspnetcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.32

Fix Suggestion:

Update to version 8.0.32

microsoft.aspnetcore.app.runtime.win-x86 (NUGET):

Affected version(s) >=10.0.0 <10.0.13

Fix Suggestion:

Update to version 10.0.13

Related Resources (5)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092

https://nvd.nist.gov/vuln/detail/CVE-2026-88092

https://github.com/dotnet/announcements/issues/472

https://github.com/dotnet/aspnetcore

https://github.com/dotnet/aspnetcore/security/advisories/GHSA-rv87-ccxw-8ggf

Do you need more information?

CVSS v4

Base Score:

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

LOW

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

LOW

Exploit Maturity

UNPROVEN

Weakness Type (CWE)

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-444

EPSS

Base Score:

0.80

AI app security

Mend AI

Application security

Mend AppSec

Dependency management

Mend Renovate

Expand coverage

Runtime and beyond

AI security

Code security

Supply chain security

Compliance & reporting

vs. AI security tools

vs. AppSec tools

Buyer’s guides

About Mend.io

Partners & people

Customers

Learn & explore

Guides

Developers hub