CVE-2026-81356: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Microsoft Visual Studio Code

CVE-2026-81356 is a vulnerability classified under CWE-444 (Inconsistent Interpretation of HTTP Requests) affecting Microsoft Visual Studio Code. It arises from how HTTP requests are inconsistently interpreted, enabling HTTP request/response smuggling attacks. This can allow an unauthorized attacker to bypass security features remotely. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. Confidentiality impact is high, integrity impact is low, and availability impact is none. The vulnerability affects Visual Studio Code versions >=1.0.0 and <1.136.2. Microsoft has issued an official fix for this vulnerability.

An attacker can exploit this vulnerability remotely without privileges but requires user interaction to bypass security features in Visual Studio Code. The impact includes high confidentiality loss and low integrity impact, with no availability impact. This could lead to unauthorized access or data exposure due to the HTTP request/response smuggling flaw.

An official fix is available from Microsoft. Users should update Visual Studio Code to version 1.136.2 or later to remediate this vulnerability. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81356 for detailed patch information and guidance.