DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-62899: CVE-2026-62899: .NET Security Feature Bypass Vulnerability (HTTP Request Smuggling)

#security #cve #cybersecurity

CVE-2026-62899: .NET Security Feature Bypass Vulnerability (HTTP Request Smuggling)

Vulnerability ID: CVE-2026-62899
CVSS Score: 5.9
Published: 2026-08-11

CVE-2026-62899 is a security feature bypass vulnerability in the Microsoft .NET runtime environment on non-Windows platforms. The flaw manifests as an HTTP Request/Response Smuggling vulnerability (CWE-444) within the managed implementation of the System.Net.HttpListener class. This allows unauthenticated remote attackers to desynchronize request boundaries when the backend .NET application is hosted behind an upstream reverse proxy.

TL;DR

A medium-severity HTTP request smuggling vulnerability in .NET on Linux and macOS allows unauthenticated remote attackers to bypass frontend security policies, hijack active user sessions, and cause cache desynchronization.

Technical Details

  • CWE ID: CWE-444
  • Attack Vector: Network (AV:N)
  • Attack Complexity: High (AC:H)
  • CVSS Base Score: 5.9 (Medium)
  • Exploit Status: No active public exploits
  • KEV Status: Not Listed

Affected Systems

  • .NET Runtime on Linux
  • .NET Runtime on macOS
  • .NET Runtime on WebAssembly
  • Microsoft .NET 10.0: >= 10.0.0, < 10.0.11 (Fixed in: 10.0.11)
  • Microsoft .NET 9.0: >= 9.0.0, < 9.0.19 (Fixed in: 9.0.19)
  • Microsoft .NET 8.0: >= 8.0.0, < 8.0.30 (Fixed in: 8.0.30)
  • Microsoft Visual Studio 2022 (version 17.14): >= 17.14.0, < 17.14.38 (Fixed in: 17.14.38)
  • Microsoft Visual Studio 2026 (version 18.8): >= 18.0, < 18.8.3 (Fixed in: 18.8.3)

Code Analysis

Commit: 18c8837

Bumps dotnet/dotnet VMR dependency to d92b8dedc2b9fde7e112d4da92db938a8d85a1b0

Commit: 551825f

[release/10.0] Update dependencies from dotnet/icu (#130746)

Commit: 6d9e1b3

[release/10.0] [QUIC] Update MsQuic to the latest 2.5 version (#130354)

Mitigation Strategies

  • Upgrade the .NET runtime and SDK to secure servicing releases.
  • Configure upstream reverse proxies to strictly normalize HTTP headers.
  • Disable connection keep-alives to prevent boundary exploitation.

Remediation Steps:

  1. Identify all Linux and macOS servers running .NET 8.0, 9.0, or 10.0.
  2. Install .NET 10.0.11, 9.0.19, or 8.0.30 or newer.
  3. Update development environments to Visual Studio 2022 (version 17.14.38) or Visual Studio 2026 (version 18.8.3).
  4. Verify reverse proxy configurations to ensure strict header RFC compliance.

References

Read the full report for CVE-2026-62899 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)