CVE-2026-88092: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an una

Q: How do I fix CVE-2026-88092?

asp.net core: upgrade to 8.0.32, 9.0.21, 10.0.13; visual studio 2022: upgrade to 17.14.42; visual studio 2026: upgrade to 18.10.4. Exact commands for each OS are on this page.

Q: Is CVE-2026-88092 being exploited?

CVE-2026-88092 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-88092 affect?

CVE-2026-88092 affects asp.net core, visual studio 2022, visual studio 2026. Severity is critical (CVSS 9.4). Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Q: How urgent is CVE-2026-88092?

Priority 61/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

This week

CRITICAL 9.4REMOTEWATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2026-88092 is a critical-severity flaw (CVSS 9.4) affecting asp.net core, visual studio 2022, visual studio 2026. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Why this priority

Critical severity
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	9.4 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.9% (top 39%)
CISA exploited list	No
Weakness	CWE-444
Published	2026-10-13
Last modified	2026-10-16

Publisher (CNA): Microsoft Corporation · Vendor: microsoft

Last updated 2026-10-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-10-13 19:21 UTCPublished CVE record published
2026-10-16 15:47 UTCUpdated Record last modified

microsoft asp.net core UPGRADE

Affected: >= 8.0.0 and < 8.0.32 · >= 9.0.0 and < 9.0.21 · >= 10.0.0 and < 10.0.13 · > 11.0.0 · 11.0 rc1

Fixed in: 8.0.32, 9.0.21, 10.0.13

Safe to downgrade to: a release before 8.0.0

1. Check installed version

apt-cache policy asp.net-core || rpm -q asp.net-core || asp.net-core --version

2. UPGRADE to 8.0.32 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade asp.net-core

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade asp.net-core

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.0.0 (Debian / Ubuntu)

apt-cache madison asp.net-core sudo apt install asp.net-core=<VERSION_BEFORE_8.0.0> sudo apt-mark hold asp.net-core

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list asp.net-core sudo dnf downgrade asp.net-core-<VERSION_BEFORE_8.0.0> sudo dnf versionlock add asp.net-core

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

microsoft visual studio 2022 UPGRADE

Affected: >= 17.14.0 and < 17.14.42

Fixed in: 17.14.42

Safe to downgrade to: a release before 17.14.0

1. Check installed version

apt-cache policy visual-studio-2022 || rpm -q visual-studio-2022 || visual-studio-2022 --version

2. UPGRADE to 17.14.42 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade visual-studio-2022

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade visual-studio-2022

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 17.14.0 (Debian / Ubuntu)

apt-cache madison visual-studio-2022 sudo apt install visual-studio-2022=<VERSION_BEFORE_17.14.0> sudo apt-mark hold visual-studio-2022

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list visual-studio-2022 sudo dnf downgrade visual-studio-2022-<VERSION_BEFORE_17.14.0> sudo dnf versionlock add visual-studio-2022

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

microsoft visual studio 2026 UPGRADE

Affected: >= 18.10.0 and < 18.10.4

Fixed in: 18.10.4

Safe to downgrade to: a release before 18.10.0

1. Check installed version

apt-cache policy visual-studio-2026 || rpm -q visual-studio-2026 || visual-studio-2026 --version

2. UPGRADE to 18.10.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade visual-studio-2026

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade visual-studio-2026

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 18.10.0 (Debian / Ubuntu)

apt-cache madison visual-studio-2026 sudo apt install visual-studio-2026=<VERSION_BEFORE_18.10.0> sudo apt-mark hold visual-studio-2026

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list visual-studio-2026 sudo dnf downgrade visual-studio-2026-<VERSION_BEFORE_18.10.0> sudo dnf versionlock add visual-studio-2026

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-arm · FIXED · 8.0.32 · vulnerable: >= 8.0.0, <= 8.0.31 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.32

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-arm64 · FIXED · 8.0.32 · vulnerable: >= 8.0.0, <= 8.0.31 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 8.0.32

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-musl-arm · FIXED · 8.0.32 · vulnerable: >= 8.0.0, <= 8.0.31 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 8.0.32

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 · FIXED · 8.0.32 · vulnerable: >= 8.0.0, <= 8.0.31 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 8.0.32

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-musl-x64 · FIXED · 8.0.32 · vulnerable: >= 8.0.0, <= 8.0.31 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 8.0.32

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-x64 · FIXED · 8.0.32 · vulnerable: >= 8.0.0, <= 8.0.31 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 8.0.32

Ubuntu 22.04 · dotnet6 · DEFERRED

Ubuntu 22.04 · dotnet8 · FIXED · 8.0.132-8.0.32-0ubuntu1~22.04.1

sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.132-8.0.32-0ubuntu1~22.04.1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · dotnet8 · FIXED · 8.0.132-8.0.32-0ubuntu1~24.04.1

sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.132-8.0.32-0ubuntu1~24.04.1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · dotnet10 · FIXED · 10.0.113-10.0.13-0ubuntu1~24.04.1

sudo apt update && sudo apt install --only-upgrade dotnet10 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet10)" ge "10.0.113-10.0.13-0ubuntu1~24.04.1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · dotnet8.0 · FIXED · dotnet8.0-8.0.132-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:86168 rpm -q dotnet8.0

RHEL 10 · dotnet9.0 · FIXED · dotnet9.0-9.0.122-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:86172 rpm -q dotnet9.0

RHEL 10 · dotnet10.0 · FIXED · dotnet10.0-10.0.113-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:86195 rpm -q dotnet10.0

RHEL 10.0 Extended Update Support · dotnet9.0 · FIXED · dotnet9.0-9.0.122-1.el10_0

sudo dnf upgrade --advisory=RHSA-2026:88424 rpm -q dotnet9.0

RHEL 10.0 Extended Update Support · dotnet8.0 · FIXED · dotnet8.0-8.0.132-1.el10_0

sudo dnf upgrade --advisory=RHSA-2026:88474 rpm -q dotnet8.0

Alpine 3.22 · dotnet8-runtime · FIXED · dotnet8-runtime-8.0.32-r0

apk add --upgrade dotnet8-runtime apk info -v dotnet8-runtime

Alpine 3.22 · dotnet9-runtime · FIXED · dotnet9-runtime-9.0.21-r0

apk add --upgrade dotnet9-runtime apk info -v dotnet9-runtime

Alpine 3.23 · dotnet10-runtime · FIXED · dotnet10-runtime-10.0.13-r0

apk add --upgrade dotnet10-runtime apk info -v dotnet10-runtime

Alpine 3.23 · dotnet8-runtime · FIXED · dotnet8-runtime-8.0.32-r0

apk add --upgrade dotnet8-runtime apk info -v dotnet8-runtime

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-3250 · source

sudo dnf update --advisory=ALAS2023-2026-3250

ASP.NET Core 8.0 · KB5130034 · FIXED · 8.0.32 · KB5130034 · source

Install KB5130034 via Windows Update, then verify: Get-HotFix -Id KB5130034

ASP.NET Core 10.0 · KB5130036 · FIXED · 10.0.13 · KB5130036 · source

Install KB5130036 via Windows Update, then verify: Get-HotFix -Id KB5130036

ASP.NET Core 9.0 · KB5130035 · FIXED · 9.0.21 · KB5130035 · source

Install KB5130035 via Windows Update, then verify: Get-HotFix -Id KB5130035

Advisories and coverage

Official advisories

Amazon Linux 2023 ALAS: ALAS2023-2026-3248 (critical): dotnet9.0 2026-10-22
Amazon Linux 2023 ALAS: ALAS2023-2026-3249 (critical): dotnet10.0 2026-10-22
Amazon Linux 2023 ALAS: ALAS2023-2026-3250 (critical): dotnet8.0 2026-10-22

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-88092?

asp.net core: upgrade to 8.0.32, 9.0.21, 10.0.13; visual studio 2022: upgrade to 17.14.42; visual studio 2026: upgrade to 18.10.4. Exact commands for each OS are on this page.

Is CVE-2026-88092 being exploited?

CVE-2026-88092 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-88092 affect?

CVE-2026-88092 affects asp.net core, visual studio 2022, visual studio 2026. Severity is critical (CVSS 9.4). Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

How urgent is CVE-2026-88092?

Priority 61/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist

Software pages

.NET vulnerabilities · Visual Studio vulnerabilities

Related CVEs

CVE-2026-40372 CRITICAL 9.1 UPGRADE Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate pr
CVE-2026-69304 MEDIUM 5.9 UPGRADE UPGRADE Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attack

References

← Back to latest CVEs