HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/2 request processing...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/2 request processing when newline characters in request trailers and values from the dynamic HPACK table are accepted instead of being treated as malformed. An attacker can bypass security controls and...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.osx-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/2 request processing...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.linux-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/2 request processi...

Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Kestrel accepts newli...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-88092

A critical HTTP request/response smuggling vulnerability exists in ASP.NET Core due to the inconsistent interpretation of HTTP requests. An unauthorized attacker can exploit this flaw to perform tampering over a network. This vulnerability has a CVSS 3.1 base score of 9.4 , indicating a high impa...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-88092

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

EUVD-2026-100147

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-99700

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-70188

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-70188

A vulnerability in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network due to the inconsistent interpretation of HTTP requests (HTTP request/response smuggling). The vulnerability is listed with a CVSS score of 9.10 and results in the exploitation of security ...

Security Bulletin: IBM Terracotta is affected by Jetty vulnerabilities that could allow attackers to bypass security controls, hijack user sessions, or access unauthorized data

Summary IBM Terracotta utilizes Jetty as a lightweight Java-based web server and servlet container that allows developers to run web applications and provide machine-to-machine communications. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1...

Security Bulletin: IBM i is Affected by an Improper Authentication Vulnerability in IBM Navigator for i [CVE-2026-93744].

Summary IBM i is vulnerable to a security bypass due to improper access control in IBM Navigator for i CVE-2026-93744 as described in the vulnerability details section. Vulnerability Details ID: CVE-2026-93744 DESCRIPTION: IBM Navigator for i could allow an unathenticated remote attacker to bypas...

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a network...

PT-2026-112910

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.linux-arm versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-arm64 versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm versions 8.0.0 through 8.0.31...