cveboard RSS feed

CVE-2026-88092

GitHubCritical, nuget

Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

No known exploitation
Severity
Critical, CVSS 9.4 (v3.1)
EPSS
0.79% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages
  • Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-x64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.osx-arm64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.osx-x64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.win-arm64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.win-x64 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.win-x86 (nuget) >= 8.0.0, <= 8.0.31, fixed in 8.0.32 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-arm64 (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-musl-arm (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.linux-x64 (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.osx-arm64 (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.osx-x64 (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf
  • Microsoft.AspNetCore.App.Runtime.win-arm64 (nuget) >= 10.0.0, <= 10.0.12, fixed in 10.0.13 · GHSA-rv87-ccxw-8ggf