CVE-2026-88092

critical · 9.4

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

9.4

CVSS

0.9%

EPSS (exploit prob.)

61st

EPSS percentile

2026-10-13

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses

CWE-444

Affected products

Vendor	Product	Affected versions
microsoft	asp.net_core	>= 8.0.0, < 8.0.32
microsoft	asp.net_core	>= 9.0.0, < 9.0.21
microsoft	asp.net_core	>= 10.0.0, < 10.0.13
microsoft	asp.net_core	> 11.0.0
microsoft	asp.net_core	11.0
microsoft	visual_studio_2022	>= 17.14.0, < 17.14.42
microsoft	visual_studio_2026	>= 18.10.0, < 18.10.4

Check a specific version with /api/v1/cve/match.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88092

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-88092