Patch Forecast
Red warning
Act within 24 hours.

CVE-2026-70188 · GHSA-fpq8-4vhr-rcxx

Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability

Risk score
82/100
CVSS
9.1 v3.1
Exploit chance (30 days)
0.9%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
Affected
Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Run…
Fix
Upgrade Microsoft.AspNetCore.App.Runtime.linux-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-mu…
Exploitation
No known exploitation

Story map

Story map: Microsoft.AspNetCore.App.Runtime.linux-armTHE FLAWSTHE FIXCVE-2026-70188Microsoft Security AdvisoryCVE-2026-70188 - ASP.NETCore Security Feature Bypass…CVSS 9.1 · EPSS 1%CVE-2026-70175Microsoft Security AdvisoryCVE-2026-70175 - ASP.NETCore Elevation of Privilege…CVSS 8.1 · EPSS 1%CVE-2026-70181Microsoft Security AdvisoryCVE-2026-70181 - ASP.NETCore Denial of Service…CVSS 7.5 · EPSS 1%CVE-2026-96236Microsoft Security AdvisoryCVE-2026-96236 - ASP.NETCore Denial of Service…CVSS 7.5 · EPSS 1%FixUpgradeMicrosoft.AspNetCore.App.Runtime.linux-arm to 11.0.0-rc.2;Microsoft.AspNetCore.App.Ru…Who is exposedMicrosoft.AspNetCore.App.Runtime.linux-arm (nuget) >=11.0.0-preview.1, <= 11.0.0-rc.1;Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >=…RED · ACT TODAYMicrosoft.AspNetCore.App.Runtim…Inconsistent interpretation ofhttp requests ('httprequest/response smuggling') inASP.NET Core allows anunauthorized attacker to bypassa security feature over anetwork.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-444 (CWE-444)28 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.AspNetCore.App.Runtime.linux-arm: Red, act today. Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

The flaws

  • CVE-2026-70188: Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability (CVSS 9.1 · EPSS 1%)
  • CVE-2026-70175: Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.1 · EPSS 1%)
  • CVE-2026-70181: Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
  • CVE-2026-96236: Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)

The fix

Fix: Upgrade Microsoft.AspNetCore.App.Runtime.linux-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 to 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-mu…

Who is exposed: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.AspNetCore.App.Run…

Where it stands

  • No known exploitation

Connects to

Why it is Red

  • CVSS 9.1 critical
  • Remotely exploitable without logging in
  • On your watchlist: asp.net core, NuGet

Affected packages

PackageEcosystemVulnerableFixed in
Microsoft.AspNetCore.App.Runtime.linux-armnuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.linux-arm64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.linux-musl-armnuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.linux-musl-x64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.linux-x64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.osx-arm64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.osx-x64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.win-arm64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.win-x64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.win-x86nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.App.Runtime.linux-armnuget>= 8.0.0, <= 8.0.318.0.32

References

Original description

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.