Asp.net Core vulnerabilities

4 known vulnerabilities in Asp.net Core from Microsoft. 4 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  ASP.NET Core 10.0: Inconsistent Interpretation of HTTP Requests

  CVE-2026-88092Oct 13, 2026MicrosoftEPSS 1.04%

  Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

• 9.9 Critical severity

  ASP.NET Core 2.3: Inconsistent Interpretation of HTTP Requests

  CVE-2025-55315Oct 14, 2025MicrosoftEPSS 67.2%

  Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

• 7.5 High severity

  HTTP/2 Rapid Reset Attack Exploited

  CVE-2023-44487Oct 10, 2023IETFEPSS 100%

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

• 7.5 High severity

  Microsoft .NET Core and Visual Studio Denial-of-Service Exploited

  CVE-2023-38180Aug 8, 2023MicrosoftEPSS 14.1%

  .NET and Visual Studio Denial of Service Vulnerability