ASP.NET Core handles HTTP requests inconsistently, enabling request/response smuggling that lets an unauthorized attacker bypass a built‑in security feature over the network. The flaw is a request‑handling weakness (CWE-444) that can allow an adversary to tamper with the order or content of HTTP messages, potentially leading to credential exposure, session hijacking or other downstream attacks once the protected feature is subverted.

Microsoft ASP.NET Core 8.0, 9.0, 10.0, and 11.0 are affected, as are Microsoft Visual Studio 2022 (version 17.14) and Visual Studio 2026 (version 18.10). Version granularity beyond the major releases is not specified.

The CVSS score of 9.1 marks this vulnerability as high severity. Although the EPSS score is not available, the lack of a KEV listing does not diminish the risk; the flaw can be exploited over the network via crafted HTTP traffic without requiring elevated privileges. Attackers can trigger the smuggling bypass by sending specially formatted requests that ASP.NET Core misparses, leading the application to interpret the requests incorrectly and bypass the security control.