ASP.NET Core EUVD-2026-99700

Exploitation requires the application to use the Kestrel web server over HTTP/2, since the flaw is specifically Kestrel accepting newline characters in HTTP/2 request trailers and in values retrieved from the dynamic HPACK table instead of rejecting them as malformed. It is remote and unauthenticated (PR:N, UI:N), so no credentials or user action are needed, but realistic impact typically depends on a proxy/load-balancer or chained server topology where request-parsing desynchronization enables smuggling to bypass a security feature. Limiting factors: endpoints that do not negotiate HTTP/2, or that terminate HTTP/2 at a non-Kestrel front end, reduce exposure; affected versions are ASP.NET Core 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 (<11.0.0-rc.2), plus bundled Visual Studio 2022 17.14 (<17.14.42) and 2026 18.10 (<18.10.4).

This is a genuinely high-priority flaw, but the signals are mixed on imminence rather than on severity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully network-reachable, requires no authentication and no user interaction, and the GHSA advisory confirms the Critical 9.1 rating with C:H/I:H - consistent with HTTP request smuggling that bypasses a security feature (CWE-444). SSVC reinforces concern: Technical Impact is 'total' and the attack is 'Automatable: yes', meaning it can be scripted at scale. However, SSVC Exploitation is 'none', there is no CISA KEV listing, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: patch urgently because the vulnerability is unauthenticated, network-facing, automatable, and in an extremely widely deployed framework, but current evidence points to no observed exploitation yet rather than active in-the-wild attacks.

A remote, unauthenticated attacker sends crafted HTTP/2 traffic to a Kestrel-fronted ASP.NET Core application, embedding newline characters in HTTP/2 request trailers or in values resolved from the dynamic HPACK table. Because Kestrel accepts these characters instead of rejecting the request as malformed, the attacker desynchronizes request parsing between Kestrel and an upstream/downstream proxy to smuggle a request and bypass a security control (e.g., authentication or access filtering). No public proof-of-concept is referenced, but the low attack complexity and automatable nature make reliable exploitation plausible once techniques are published.