Description

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-11T17:18:44.120Z",
  "pubdate": "2026-08-11T17:18:44.120Z",
  "executiveSummary": "An HTTP request/response smuggling vulnerability exists within the .NET framework due to inconsistent interpretation of HTTP requests across network components. This security flaw allows an unauthorized remote attacker to bypass implemented security features over a network without requiring prior authentication or specific privileges.\nThe vulnerability stems from discrepancies in how front-end proxies and the underlying .NET HTTP parsing engine delimit the boundaries of HTTP messages, particularly when handling ambiguous or malformed request headers such as Transfer-Encoding and Content-Length. By crafting specialized payload sequences, an attacker can manipulate request pipelining to inject arbitrary HTTP requests into the processing queue of the target application.\nSuccessful exploitation of this vulnerability can lead to severe security implications, including unauthorized access to sensitive backend functionalities, security control bypass, cache poisoning, and potential session hijacking. The impact compromises the confidentiality, integrity, and availability of the affected .NET applications and their underlying services. Exploitation requires network access to the target application and precise manipulation of HTTP protocol semantics to induce desynchronization between intermediary proxies and the .NET HTTP server stack.",
  "technicalDetails": "The root cause of this vulnerability is rooted in RFC compliance deviations and ambiguous parsing logic within the .NET HTTP processing stack when evaluating multi-header or conflicting framing directives. Specifically, discrepancies arise when simultaneous Content-Length and Transfer-Encoding headers are present, or when obfuscated transfer encodings are processed, leading to divergent interpretations of request body boundaries between an upstream reverse proxy or load balancer and the downstream .NET application server.\nThe vulnerable component resides within the .NET HTTP request parser and message handling pipeline responsible for reading and delimiting incoming HTTP streams. Because the network exposure is over a network, an unauthenticated remote attacker can interact directly with the publicly accessible endpoints of the .NET application.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious HTTP request containing conflicting or ambiguous framing headers designed to be interpreted differently by the front-end proxy and the backend .NET server. Second, the attacker transmits this payload over a persistent TCP or HTTP/1.1 connection. Third, the front-end proxy processes a portion of the stream based on its parsing rules, forwarding what it believes to be a single, complete request to the .NET backend. Meanwhile, the backend .NET server reads the stream differently, misinterpreting the remaining bytes as the beginning of a subsequent, smuggled request.\nFourth, the smuggled request sits un-keyed or appended to the next legitimate user's request processed by the same backend worker thread or connection pool. Fifth, when a victim user sends a legitimate request, it is concatenated with the attacker's smuggled payload, causing the backend server to execute the smuggled action under the context of the persistent connection or the victim's session.\nThe payload behavior alters the expected transaction sequence, effectively bypassing web application firewalls (WAFs), authentication gates, and access control lists positioned at the perimeter proxy layer. Post-exploitation impact includes unauthorized data exfiltration, execution of privileged commands, or unauthorized modification of server-side state via desynchronized request routing."
}