CVE-2026-70188 in ASP.NET Core
Summary
by MITRE • 10/14/2026
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves inconsistent interpretation of HTTP requests within the ASP.NET Core framework, commonly referred to as HTTP Request Smuggling or HTTP Desync attacks. This class of vulnerabilities arises when there is a discrepancy in how different components interpret the boundaries and structure of an HTTP request. In typical web architectures, traffic flows from a client through one or more intermediate proxies before reaching the backend application server. If these intermediaries and the final destination disagree on where one request ends and another begins, it creates an opportunity for manipulation that can lead to severe security breaches. The specific issue in ASP.NET Core allows an unauthorized attacker to exploit this inconsistency by crafting maliciously formatted HTTP requests that are parsed differently by a front-end proxy or load balancer compared to how the ASP.NET Core runtime processes them.
The technical flaw centers on the handling of transfer encoding and content length headers, which define the size and structure of request bodies. When an attacker sends a request containing conflicting indicators for body length, such as both Content-Length and Transfer-Encoding: chunked headers, different systems may resolve this ambiguity in opposing ways. For instance, a front-end proxy might strip one header or interpret the payload based on its own logic, while ASP.NET Core interprets the remaining data differently. This divergence allows an attacker to smuggle additional requests into the backend server's input stream without being detected by security controls that operate at the network perimeter. The attacker essentially hides their malicious intent within the legitimate traffic flow, exploiting the gap between the proxy’s view and the application server’s reality.
The operational impact of this vulnerability is significant because it enables attackers to bypass critical security features implemented at various layers of the infrastructure. By successfully smuggling requests, an adversary can perform unauthorized actions on behalf of other users, such as stealing session cookies or performing cross-site scripting attacks that would normally be blocked by Web Application Firewalls (WAFs). Since the WAF often inspects traffic based on its own interpretation of the request boundaries, it may fail to detect the smuggled malicious payload because it sees a different structure than what reaches the application. This can lead to data exfiltration, account takeover, and complete compromise of user integrity within the affected web applications.
Mitigation strategies for this vulnerability require careful configuration of both the ASP.NET Core runtime and any upstream infrastructure components like reverse proxies or load balancers. Developers should ensure that their applications strictly validate incoming requests and reject those with ambiguous or conflicting headers unless explicitly supported by a well-defined security policy. It is crucial to align the behavior of all network intermediaries with the backend application’s parsing logic. This often involves disabling features that allow for multiple transfer encodings simultaneously or configuring proxies to normalize requests before forwarding them. Additionally, keeping ASP.NET Core updated to the latest version ensures access to patches and improved default configurations designed to prevent such desynchronization attacks. Regular security audits focusing on HTTP protocol handling can further identify potential points of inconsistency in complex deployment architectures.