CVE-2026-70188: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Microsoft ASP.NET Core 10.0

Microsoft ASP.NET Core's Kestrel server accepts newline characters in HTTP/2 request trailers and values retrieved from the dynamic HPACK table instead of treating them as malformed, leading to inconsistent interpretation of HTTP requests (CWE-444). This vulnerability enables HTTP Request/Response Smuggling attacks. It affects multiple runtime packages across Linux, macOS, and Windows platforms for versions ranging from 8.0 up to certain patched versions, including preview and release candidate versions of 11.0. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low complexity, no privileges or user interaction required, with high confidentiality and integrity impact but no availability impact. Microsoft has issued official fixes in updated package versions.

The vulnerability allows attackers to exploit inconsistent HTTP request parsing, potentially enabling HTTP Request/Response Smuggling attacks. This can lead to unauthorized information disclosure and manipulation of HTTP traffic integrity. The CVSS score of 9.1 indicates a critical severity with high confidentiality and integrity impact. There is no known exploitation in the wild at this time.

Microsoft has released official patches for affected Microsoft.AspNetCore.App.Runtime packages. Users and developers should update to the patched versions (e.g., 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2, 17.14.42, 18.10.4) as soon as possible to remediate this vulnerability. Applying these updates removes the vulnerability. No additional mitigation steps are indicated by the vendor advisory.