MicrosoftAnalysisMicrosoft fixes critical ASP.NET Core Kestrel HTTP request smuggling flaw
What happened.Microsoft released security updates addressing a critical security feature bypass vulnerability in the ASP.NET Core Kestrel web server engine that allows remote HTTP request smuggling.
Why it matters.Edge proxies and application servers must interpret protocol framing rules identically to protect upstream authentication decisions. When application servers process illegal control characters that reverse proxies ignore, attackers can bypass perimeter access controls and hijack authenticated user sessions. Development leads must update ASP.NET Core runtime hosting bundles and rebuild affected microservices immediately. Platform teams should inspect edge proxy logs for abnormal carriage return characters in request headers.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-70188 with a 9.1 CVSS score, Kestrel accepts newline characters in HTTP/2 trailers and dynamic HPACK tables instead of rejecting malformed frames.
- Exploitation path: Remote attackers send crafted HTTP requests through upstream reverse proxies to desynchronize message boundaries, enabling request smuggling, cache poisoning, and authentication filter bypasses.
- Remediation releases: Microsoft distributed patched NuGet packages and runtime hosting bundles across supported .NET versions, instructing development teams to update dependencies to fixed releases.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: