Description
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
Published: 2026-08-11
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is caused by inconsistent handling of HTTP requests in the .NET framework, enabling request smuggling. This smuggling can bypass a security feature that checks request integrity, allowing an attacker to perform unauthorized actions through the network.

Affected Systems

Microsoft .NET 10.0, .NET 8.0, and .NET 9.0, as well as Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.8 are affected. The issue lies in the HTTP request parser of these runtimes and IDE versions.

Risk and Exploitability

The CVSS score of 5.9 indicates medium severity, while the EPSS probability of less than 1% points to a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. Attackers would need active network access to craft smuggled requests; success depends on the target interpreting the request incorrectly.

Generated by OpenCVE AI on August 12, 2026 at 16:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the official Microsoft security update that addresses CVE-2026-62899 on every affected .NET runtime (8.0, 9.0, 10.0) and Visual Studio installation (17.14/18.8).
  • Review and tighten application code to enforce strict HTTP header validation, ensuring consistent request parsing and preventing smuggling patterns.
  • Deploy network‑level defenses such as Web Application Firewalls or traffic monitoring tools to detect and block request smuggling attempts.

Generated by OpenCVE AI on August 12, 2026 at 16:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-r6mh-95jw-g7qg Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
History

Mon, 17 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft microsoft Visual Studio 2022
Microsoft microsoft Visual Studio 2026
Vendors & Products Microsoft microsoft Visual Studio 2022
Microsoft microsoft Visual Studio 2026

Fri, 14 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft windows
CPEs cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft windows

Wed, 12 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 11 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
Title .NET Security Feature Bypass Vulnerability
First Time appeared Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
Weaknesses CWE-444
CPEs cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}

Subscriptions

Apple Macos
Linux Linux Kernel
Microsoft .net Microsoft Visual Studio 2022 Microsoft Visual Studio 2026 Visual Studio 2022 Visual Studio 2026 Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-08-31T20:05:25.059Z

Reserved: 2026-07-14T21:25:21.035Z

Link: CVE-2026-62899

cve-icon Vulnrichment

Updated: 2026-08-12T13:50:47.289Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-11T17:18:44.120

Modified: 2026-08-14T13:56:52.390

Link: CVE-2026-62899

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-11T00:00:00Z

Links: CVE-2026-62899 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T11:15:03Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')