{"uuid": "014d8518-d7fe-43fc-89d6-0f140832ddd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62899", "type": "seen", "source": "https://gist.github.com/alon710/ee3d380af55d943c49a24084c4a98242", "content": "# CVE-2026-62899: CVE-2026-62899: .NET Security Feature Bypass Vulnerability (HTTP Request Smuggling)\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62899\n\n## Summary\nCVE-2026-62899 is a security feature bypass vulnerability in the Microsoft .NET runtime environment on non-Windows platforms. The flaw manifests as an HTTP Request/Response Smuggling vulnerability (CWE-444) within the managed implementation of the System.Net.HttpListener class. This allows unauthenticated remote attackers to desynchronize request boundaries when the backend .NET application is hosted behind an upstream reverse proxy.\n\n## TL;DR\nA medium-severity HTTP request smuggling vulnerability in .NET on Linux and macOS allows unauthenticated remote attackers to bypass frontend security policies, hijack active user sessions, and cause cache desynchronization.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **CVSS Base Score**: 5.9 (Medium)\n- **Exploit Status**: No active public exploits\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- .NET Runtime on Linux\n- .NET Runtime on macOS\n- .NET Runtime on WebAssembly\n- **Microsoft .NET 10.0**: >= 10.0.0, < 10.0.11 (Fixed in: `10.0.11`)\n- **Microsoft .NET 9.0**: >= 9.0.0, < 9.0.19 (Fixed in: `9.0.19`)\n- **Microsoft .NET 8.0**: >= 8.0.0, < 8.0.30 (Fixed in: `8.0.30`)\n- **Microsoft Visual Studio 2022 (version 17.14)**: >= 17.14.0, < 17.14.38 (Fixed in: `17.14.38`)\n- **Microsoft Visual Studio 2026 (version 18.8)**: >= 18.0, < 18.8.3 (Fixed in: `18.8.3`)\n\n## Mitigation\n\n- Upgrade the .NET runtime and SDK to secure servicing releases.\n- Configure upstream reverse proxies to strictly normalize HTTP headers.\n- Disable connection keep-alives to prevent boundary exploitation.\n\n**Remediation Steps:**\n1. Identify all Linux and macOS servers running .NET 8.0, 9.0, or 10.0.\n2. Install .NET 10.0.11, 9.0.19, or 8.0.30 or newer.\n3. Update development environments to Visual Studio 2022 (version 17.14.38) or Visual Studio 2026 (version 18.8.3).\n4. Verify reverse proxy configurations to ensure strict header RFC compliance.\n\n## References\n\n- [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62899)\n- [NVD - CVE-2026-62899](https://nvd.nist.gov/vuln/detail/CVE-2026-62899)\n- [dotnet/runtime Commit 18c88378](https://github.com/dotnet/runtime/commit/18c88378c1c70a0b3a2c69d783f89b8a8ea0143e)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62899) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T02:31:42.864308Z"}