CVE-2026-62899

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.HttpListener. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/427

CVSS Details

• Version: 3.1
• Severity: Medium
• Score: 5.9
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
• Weakness: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected Platforms

• Platforms: Linux, macOS
• Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

<a name=".NET 10"></a>.NET 10

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.10 | 10.0.11 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.10 | 10.0.11 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.10 | 10.0.11 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.10 | 10.0.11 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.10 | 10.0.11 Microsoft.NETCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.10 | 10.0.11 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.10 | 10.0.11 Microsoft.NETCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.10 | 10.0.11

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.18 | 9.0.19 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.18 | 9.0.19 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.18 | 9.0.19 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.18 | 9.0.19 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.18 | 9.0.19 Microsoft.NETCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.18 | 9.0.19 Microsoft.NETCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.18 | 9.0.19 Microsoft.NETCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.18 | 9.0.19

<a name=".NET 8"></a>.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | -------------------------…

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.130 Runtime version: 8.0.30

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 (JIRA:Rocky Linux-235468)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.130 Runtime version: 8.0.30

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [rhel-10.2.z] (JIRA:Rocky Linux-235472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.111 Runtime version: 10.0.11

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 (JIRA:Rocky Linux-235478)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120 Runtime version: 9.0.19

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 (JIRA:Rocky Linux-235473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.130 Runtime version: 8.0.30

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [rhel-9.8.z] (JIRA:Rocky Linux-235471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120 Runtime version: 9.0.19

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [rhel-10.2.z] (JIRA:Rocky Linux-235477)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120 Runtime version: 9.0.19

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [rhel-9.8.z] (JIRA:Rocky Linux-235476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.111 Runtime version: 10.0.11

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [rhel-9.8.z] (JIRA:Rocky Linux-235481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.111 Runtime version: 10.0.11

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)

• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [rhel-10.2.z] (JIRA:Rocky Linux-235482)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.130
Runtime version: 8.0.30

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 (JIRA:AlmaLinux-235468)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.130
Runtime version: 8.0.30

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-10.2.z] (JIRA:AlmaLinux-235472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.111
Runtime version: 10.0.11

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 (JIRA:AlmaLinux-235478)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120
Runtime version: 9.0.19

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 (JIRA:AlmaLinux-235473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.130
Runtime version: 8.0.30

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-9.8.z] (JIRA:AlmaLinux-235471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120
Runtime version: 9.0.19

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-10.2.z] (JIRA:AlmaLinux-235477)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.120
Runtime version: 9.0.19

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-9.8.z] (JIRA:AlmaLinux-235476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.111
Runtime version: 10.0.11

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-9.8.z] (JIRA:AlmaLinux-235481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.111
Runtime version: 10.0.11

Security Fix(es):

• .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899)
• .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900)
• .NET: .NET Denial of Service Vulnerability (CVE-2026-62901)
• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-10.2.z] (JIRA:AlmaLinux-235482)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Miha Zupan discovered that .NET did not properly interpret certain HTTP requests. An attacker could possibly use this issue to perform request smuggling and bypass a security feature. (CVE-2026-62899)

Ivan Demchuk discovered that .NET did not properly handle the removal of sensitive information before storage or transfer. An attacker could possibly use this issue to disclose sensitive information. (CVE-2026-62900)

Kevin Gosse discovered that .NET did not properly check an input for a loop condition. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-62901)

Kevin Gosse discovered that .NET did not properly perform error checking when securing shared resources used for diagnostics IPC. An attacker could possibly use this issue to elevate privileges. (CVE-2026-62909)