CVE-2026-62899: .NET HTTP Smuggling Vulnerability

CVE-2026-62899 Overview

CVE-2026-62899 is an HTTP request smuggling vulnerability in Microsoft .NET. The flaw stems from inconsistent interpretation of HTTP requests between .NET components and upstream proxies or load balancers. An unauthenticated remote attacker can craft ambiguous HTTP messages to bypass security features enforced at the network edge. The vulnerability is tracked under CWE-444: Inconsistent Interpretation of HTTP Requests. Microsoft published the advisory on August 11, 2026, and the issue affects services built on the .NET HTTP stack. See the Microsoft Security Update CVE-2026-62899 advisory for vendor guidance.

Critical Impact
Attackers can smuggle a second HTTP request past front-end security controls, bypassing authentication, WAF rules, and access policies enforced only at the proxy layer.

Affected Products

Microsoft .NET (see the Microsoft advisory for exact supported versions)
Applications hosting HTTP endpoints on the affected .NET runtime
Services deployed behind reverse proxies or load balancers using the affected .NET HTTP parser

Discovery Timeline

2026-08-11 - CVE-2026-62899 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62899

Vulnerability Analysis

HTTP request smuggling occurs when two HTTP processors in the same request chain disagree on where one request ends and the next begins. In this case, the .NET HTTP parser interprets a request differently than an upstream intermediary. An attacker exploits this disagreement to prepend or append content to another user's request or to route hidden requests past perimeter controls.

The attack requires network reachability to the exposed HTTP endpoint. Exploitation depends on a specific deployment topology in which .NET sits behind a proxy, CDN, or load balancer that performs its own HTTP parsing. Impact is limited to confidentiality of downstream requests and bypass of security features. The issue does not directly enable code execution or data modification, but smuggled requests can carry payloads that reach otherwise protected endpoints.

Root Cause

The root cause is inconsistent parsing of HTTP framing headers, typically Content-Length and Transfer-Encoding, between .NET and cooperating HTTP intermediaries. When one component prioritizes one header and the other prioritizes the alternative, request boundaries desynchronize. This desynchronization allows a single TCP or TLS connection to carry a smuggled request that the front end never validated.

Attack Vector

The attacker sends a specially crafted HTTP request over the network to a public endpoint. The malicious request contains conflicting or malformed framing headers. The proxy forwards what it considers one request, while .NET treats the body as the start of a second request. The smuggled request bypasses proxy-enforced authentication, rate limiting, or WAF inspection. See the Microsoft Security Update CVE-2026-62899 advisory for exploitation prerequisites and version-specific detail.

Detection Methods for CVE-2026-62899

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers reaching .NET services
Requests with duplicated or obfuscated Transfer-Encoding headers such as Transfer-Encoding: xchunked or space-prefixed variants
Unexpected HTTP methods or paths appearing in .NET application logs that were not logged by the upstream proxy
Response mismatches where one client receives another client's response body on shared connections

Detection Strategies

Correlate front-end proxy access logs with .NET application logs and alert on request counts that diverge between the two tiers
Deploy WAF signatures that reject HTTP/1.1 requests containing conflicting framing headers before they reach .NET
Inspect long-lived keep-alive connections for anomalous pipelined requests that were not initiated by legitimate clients

Monitoring Recommendations

Enable verbose HTTP parser logging on both proxy and .NET tiers during triage
Monitor for spikes in 400-class responses tied to malformed framing headers
Track authentication events for requests that reach protected endpoints without a corresponding proxy-side auth log entry

How to Mitigate CVE-2026-62899

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62899
Inventory all internet-facing services running on affected .NET versions and prioritize those behind shared proxies or CDNs
Configure upstream proxies to normalize or reject requests containing both Content-Length and Transfer-Encoding headers

Patch Information

Microsoft has released a security update addressing CVE-2026-62899. Refer to the Microsoft Security Update CVE-2026-62899 advisory for the exact patched build numbers per supported .NET version and for guidance on redistributing updated runtimes with applications.

Workarounds

Disable HTTP/1.1 keep-alive on the proxy tier to prevent multiple requests from sharing a single connection to .NET
Enforce strict HTTP parsing at the WAF or reverse proxy and reject requests with ambiguous framing headers
Terminate HTTP/2 or HTTP/3 at the edge and downgrade to strictly validated HTTP/1.1 only when necessary

bash

# Example NGINX hardening to reject conflicting framing headers
map $http_transfer_encoding $bad_te {
    default 0;
    "~*chunked" 1;
}

server {
    listen 443 ssl;

    if ($http_content_length != "") {
        set $has_cl 1;
    }

    if ($bad_te$has_cl = "11") {
        return 400;
    }

    location / {
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_pass http://dotnet_backend;
    }
}