EUVD-2026-56407
GHSA-r6mh-95jw-g7qg
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable HttpListener needs no auth (PR:N), but smuggling requires a specific proxy intermediary disagreement (AC:H); only confidentiality is impacted, not integrity or availability.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attackers to bypass security features on Linux and macOS deployments. The flaw stems from inconsistent HTTP request interpretation (CWE-444), allowing crafted requests to circumvent authentication or access controls with high confidentiality impact. Exploitation carries high attack complexity (AC:H), no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in a monitored-but-not-emergency posture for most organizations.
Technical ContextAI
System.Net.HttpListener is a managed .NET component providing a programmatic, self-hosted HTTP server, distinct from IIS or Kestrel. CWE-444 (HTTP Request Smuggling) arises when front-end intermediaries and the back-end listener interpret HTTP message boundaries differently - typically via ambiguous Content-Length vs. Transfer-Encoding header handling - allowing an attacker to prepend or append a hidden request that the intermediary never sees but the back-end processes. The GHSA advisory (GHSA-r6mh-95jw-g7qg) confirms the affected component is System.Net.HttpListener and explicitly limits the vulnerable platforms to Linux and macOS, with all architectures affected. Windows deployments are not listed as affected. Affected NuGet packages include all linux-arm, linux-arm64, linux-musl-*, linux-x64, osx-arm64, and osx-x64 runtime variants across the affected .NET version ranges.
RemediationAI
Upgrade to the vendor-released patched runtimes: .NET 8.0 → 8.0.30, .NET 9.0 → 9.0.19, .NET 10.0 → 10.0.11, Visual Studio 2022 17.14 → 17.14.38, and Visual Studio 2026 18.8 → 18.8.3. Update corresponding NuGet runtime packages (Microsoft.NETCore.App.Runtime.*) to their fixed versions as listed in the GHSA advisory at https://github.com/dotnet/runtime/security/advisories/GHSA-r6mh-95jw-g7qg. If immediate patching is not possible, a targeted compensating control is to configure the upstream reverse proxy or load balancer to reject or normalize ambiguous HTTP requests containing both Content-Length and Transfer-Encoding headers - most modern proxies (nginx: 'proxy_request_buffering on'; HAProxy: 'option http-buffer-request') support this, though it may break some legitimate clients using non-standard header combinations. Alternatively, restricting direct network exposure of System.Net.HttpListener endpoints so they are not reachable through an HTTP intermediary eliminates the smuggling attack surface entirely, at the cost of losing reverse-proxy benefits. Full announcement at https://github.com/dotnet/announcements/issues/427.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today