CVE-2026-70188
Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability
Published Oct 13, 2026
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Kestrel accepts newline characters in HTTP/2 request trailers and values retrieved from the dynamic HPACK table instead of treating them as malformed.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Kestrel accepts newline characters in HTTP/2 request trailers and values retrieved from the dynamic HPACK table instead of treating them as ma
Affected
- nuget microsoft.aspnetcore.app.runtime.linux-arm64version unspecified
- nuget microsoft.aspnetcore.app.runtime.linux-musl-arm64version unspecified
- nuget microsoft.aspnetcore.app.runtime.osx-arm64version unspecified
- nuget microsoft.aspnetcore.app.runtime.win-x86version unspecified
Sources
- CVE.orgCVE-2026-70188
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-70188
30-day exploitation probability 0.8%
first.org - GitLab Advisory DatabaseCVE-2026-70188
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Kestrel accepts newline characters in HTTP/2 request trailers and values retrieved from the dynamic HPACK table instead of treating them as ma
advisories.gitlab.com