asp.net core vulnerabilities and fixes

Recent CVEs affecting asp.net core, with upgrade or downgrade steps. 3 tracked.

Also searched as: asp net core, asp.netcore, aspnet core.

asp.net core has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-10-13. Highest priority: CVE-2026-40372 (score 69/100).

• CVE-2026-40372 CRITICAL 9.1 UPGRADE Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate pr
• CVE-2026-88092 CRITICAL 9.4 UPGRADE UPGRADE Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an una
• CVE-2026-69304 MEDIUM 5.9 UPGRADE UPGRADE Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attack

FAQ

How do I fix asp.net core vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is asp.net core being exploited right now?

None of the tracked asp.net core CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which asp.net core CVE should I patch first?

CVE-2026-40372 currently ranks highest (69/100): Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate pr.

RSS feed for asp.net core · ← Back to latest CVEs