CVE-2026-88092: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Microsoft ASP.NET Core 10.0

This vulnerability (CWE-444) in Microsoft.AspNetCore.Server.Kestrel.Core allows an attacker to exploit inconsistent parsing of HTTP requests. When a Kestrel HTTP/1 connection is aborted, unread bytes from the request body may be interpreted as a separate HTTP request, leading to request smuggling or desynchronization attacks. The issue affects multiple runtime packages across various platforms and architectures. Microsoft has issued patches in versions 8.0.32, 9.0.21, 10.0.13, 17.14.42, and 18.10.4 to remediate this vulnerability.

Successful exploitation could allow an attacker to perform HTTP request/response smuggling, potentially leading to request desynchronization. This can result in unauthorized request processing, information disclosure, or other impacts on confidentiality, integrity, and availability. The CVSS v3.1 score is 9.4 (Critical), reflecting high impact on confidentiality and integrity with low attack complexity and no required privileges or user interaction.

An official fix is available from Microsoft. Users and developers should update affected Microsoft.AspNetCore.App.Runtime packages to the patched versions (e.g., 8.0.32, 9.0.21, 10.0.13, 17.14.42, 18.10.4) as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092 for detailed update instructions. No additional mitigations are specified by the vendor.