CVE-2026-62899: .NET Security Feature Bypass Vulnerability (HTTP Request Smuggling)

CVE-2026-62899 represents a security feature bypass vulnerability in the Microsoft .NET runtime environment on non-Windows platforms. The flaw arises from an HTTP Request/Response Smuggling vulnerability, classified as CWE-444, within the managed implementation of the System.Net.HttpListener class.

While Windows implementations delegate HTTP parsing to the robust, kernel-level http.sys driver, non-Windows systems (including Linux and macOS) rely on a custom, managed C# HTTP parser. This architectural difference introduces discrepancies in how HTTP request boundaries are parsed and validated compared to upstream reverse proxies like Nginx or HAProxy.

An unauthenticated remote attacker can exploit these parsing inconsistencies to desynchronize the connection boundaries between the reverse proxy and the backend .NET server. This desynchronization enables the attacker to inject a hidden secondary request within the body of a primary request, leading to security control bypasses or unauthorized data exposure.

The root cause of CVE-2026-62899 lies in inconsistent parsing logic and character normalization routines inside the managed C# HTTP parser of System.Net.HttpListener. When the parser processes incoming headers, it handles whitespaces and character normalization in an overly permissive manner, deviating from strict RFC standards.

Specifically, the managed parser's integration with ICU (International Components for Unicode) globalization libraries created a normalization vulnerability. If HTTP headers are validated using culture-aware string methods rather than strict, binary-level ordinal checks, certain full-width Unicode characters can be normalized into standard ASCII control characters like colons or line endings. This allows an attacker to construct headers that appear benign to an upstream proxy but are interpreted as structural boundaries by the backend .NET runtime.

Furthermore, the parser failed to strictly enforce RFC 9112 rules regarding trailing and leading whitespaces in header fields, particularly around the colon delimiter. The permissive handling of malformed headers (such as Transfer-Encoding : chunked) allows an attacker to cause a desynchronization where the frontend proxy ignores the header due to strict validation, while the backend processes it, or vice versa.

The remediation of this vulnerability required updating key parsing components and upgrading native and managed dependencies within the .NET runtime. Developers resolved the ICU normalization issue by enforcing strict ASCII/ordinal string comparisons on all HTTP header fields, preventing Unicode normalization side-channels.

In addition, native transport libraries were upgraded to enforce stricter boundary validation. The native MsQuic library was bumped from version 2.4.18 to 2.5.9 within the eng/Versions.props file to resolve potential state machine issues in HTTP/3 transport processing. The following diff highlights the dependency transitions implemented in the servicing branch:

<!-- eng/Versions.props -->
<Project>
  <PropertyGroup>
-   <MicrosoftNativeQuicMsQuicSchannelVersion>2.4.18</MicrosoftNativeQuicMsQuicSchannelVersion>
+   <MicrosoftNativeQuicMsQuicSchannelVersion>2.5.9</MicrosoftNativeQuicMsQuicSchannelVersion>
  </PropertyGroup>
</Project>

The Microsoft.NETCore.Runtime.ICU.Transport package was also updated across multiple cycles to secure the globalization boundary. Specifically, the package version was rolled from 10.0.0-rtm.26313.1 to 10.0.0-rtm.26364.2 to eliminate character-mapping discrepancies.

Exploiting CVE-2026-62899 requires a deployment scenario where the backend .NET application is hosted on Linux or macOS behind an affected frontend reverse proxy. The attacker targets the connection state using standard HTTP Request Smuggling vectors, such as CL.TE or TE.CL.

In a CL.TE scenario, the attacker transmits a single TCP payload containing a standard Content-Length header and a malformed Transfer-Encoding : chunked header with a trailing whitespace. The frontend proxy, validating strictly, reads the request according to the Content-Length field and forwards the entire stream. The backend .NET parser, being overly permissive, normalizes the malformed Transfer-Encoding header and treats the body as chunked data.

When the backend server encounters the terminating chunk (0), it concludes the processing of the first request. The remaining bytes in the connection buffer are then parsed as a new, separate HTTP request. This secondary, smuggled request executes in the context of the established TCP connection, bypassing access lists enforced by the frontend proxy.

The impact of a successful HTTP request smuggling exploit is classified as high for confidentiality. An attacker who successfully desynchronizes a persistent connection can intercept and manipulate the requests and responses of other users sharing that connection.

This capability allows the attacker to hijack active sessions by capturing sensitive headers, authorization tokens, or session cookies. Additionally, if a caching proxy is utilized in the architecture, the attacker can execute web cache poisoning attacks, storing malicious responses on the proxy to be served to subsequent legitimate users.

From a CVSS perspective, the vulnerability receives a base score of 5.9 (Medium). The score reflects high confidentiality impact but zero direct integrity or availability impact because the vulnerability does not natively permit code execution or persistent data modification. However, the downstream impact of session hijacking can lead to complete application compromise.

Resolving CVE-2026-62899 requires updating the .NET SDK and runtime to the latest patched servicing releases. Organizations running applications on Linux or macOS must upgrade to .NET 10.0.11, .NET 9.0.19, or .NET 8.0.30 immediately to receive the secure HTTP parser implementation.

Where immediate patching of the runtime is unfeasible, several mitigating controls can be implemented. Administrators should configure their frontend reverse proxies (such as Nginx or HAProxy) to normalize incoming HTTP headers strictly, ensuring that requests containing conflicting framing or non-standard whitespaces are rejected before reaching the backend.

Alternatively, disabling connection keep-alives at the reverse proxy or backend level will mitigate the threat of smuggling by forcing the termination of the TCP connection after each request. However, this mitigation is not recommended as a long-term solution because it introduces significant latency and processing overhead due to repeated TCP handshakes.