Threat Advisory

Microsoft ASP NET Core Runtime Vulnerability Allows Malicious HTTP Requests

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: Critical
[subscribe_to_unlock_form]


EXECUTIVE SUMMARY:

A critical vulnerability, CVE-2026-70188, with a CVSS score of 9.1, exists in Microsoft.AspNetCore.Server.Kestrel.Core that allows an attacker to bypass security features via HTTP/2 request trailers and values retrieved from the dynamic HPACK table. This flaw impacts Windows, Linux, and macOS platforms, specifically affecting .NET projects using vulnerable Microsoft.AspNetCore.App.Runtime packages. The vulnerability is caused by the server accepting newline characters in HTTP/2 request trailers instead of treating them as malformed, which can lead to inconsistent interpretation of HTTP requests. The flaw type is Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling), with a network attack vector and business impacts that include unauthorized data access and modification.[/subscribe_to_unlock_form]


EXECUTIVE SUMMARY:

A critical vulnerability, CVE-2026-70188, with a CVSS score of 9.1, exists in Microsoft.AspNetCore.Server.Kestrel.Core that allows an attacker to bypass security features via HTTP/2 request trailers and values retrieved from the dynamic HPACK table. This flaw impacts Windows, Linux, and macOS platforms, specifically affecting .NET projects using vulnerable Microsoft.AspNetCore.App.Runtime packages. The vulnerability is caused by the server accepting newline characters in HTTP/2 request trailers instead of treating them as malformed, which can lead to inconsistent interpretation of HTTP requests. The flaw type is Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling), with a network attack vector and business impacts that include unauthorized data access and modification.[emaillocker id="1283"]

 

RECOMMENDATIONS:

  • We recommend you to update Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm, Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-x64, Microsoft.AspNetCore.App.Runtime.linux-x64, Microsoft.AspNetCore.App.Runtime.osx-arm64, Microsoft.AspNetCore.App.Runtime.osx-x64, Microsoft.AspNetCore.App.Runtime.win-arm64 , Microsoft.AspNetCore.App.Runtime.win-x64 and Microsoft.AspNetCore.App.Runtime.win-x86 to below version:
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70188

 

REFERENCES:

The following reports contain further technical details:
https://github.com/advisories/GHSA-fpq8-4vhr-rcxx

[/emaillocker]
crossmenu