CVE-2026-62899: 
C# vulnerability analysis and mitigation

CVE-2026-62899 is a .NET Security Feature Bypass vulnerability caused by inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in System.Net.HttpListener. Disclosed on August 11, 2026, as part of Microsoft's August 2026 Patch Tuesday, it affects .NET 8.0 (< 8.0.30), .NET 9.0 (< 9.0.19), .NET 10.0 (< 10.0.11), Visual Studio 2022 (17.14.0–17.14.37), and Visual Studio 2026 (18.8.0–18.8.2) on Linux and macOS platforms. It carries a CVSS v3.1 base score of 5.9 (Medium) (MSRC Advisory, GitHub Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests — HTTP Request/Response Smuggling). Specifically, the managed System.Net.HttpListener implementation incorrectly parses the Content-Length header on Linux and .NET Core, allowing an attacker to craft HTTP requests that are interpreted differently by the .NET listener versus upstream proxies or intermediaries. This discrepancy can be exploited over the network without authentication or user interaction, though exploitation requires high attack complexity (e.g., precise timing or specific proxy configurations). The vulnerability was discovered by Miha Zupan of Microsoft and announced via the dotnet/announcements repository (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to bypass security features in .NET applications using System.Net.HttpListener, potentially gaining unauthorized access to sensitive information (high confidentiality impact). Integrity and availability are not directly impacted. The vulnerability is limited in scope to Linux and macOS deployments; Windows-based .NET applications are not affected. In environments where the listener sits behind a reverse proxy or load balancer, request smuggling could enable cache poisoning, session hijacking, or access to restricted endpoints (GitHub Advisory, MSRC Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.72%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and automation as "no," reflecting the high attack complexity required (GitHub Advisory, MSRC Advisory).

Microsoft has released patched versions addressing this vulnerability. Update to the following versions immediately:

• .NET 8.x: upgrade to 8.0.30 or later
• .NET 9.x: upgrade to 9.0.19 or later
• .NET 10.x: upgrade to 10.0.11 or later
• Visual Studio 2022: upgrade to 17.14.38 or later
• Visual Studio 2026: upgrade to 18.8.3 or later

Self-contained applications targeting affected versions must be recompiled and redeployed after updating the SDK. Restart all running applications after applying updates. Red Hat Enterprise Linux users should apply the relevant RHSA errata (RHSA-2026:54538 through RHSA-2026:55858) for their RHEL version. Ubuntu users should apply USN-8641-1 (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was covered as part of broader August 2026 Patch Tuesday reporting, with outlets such as BleepingComputer and GBHackers noting it among approximately 400 flaws addressed that month. Microsoft's .NET team published a servicing update blog post and a formal announcement in the dotnet/announcements GitHub repository. Red Hat issued multiple errata (RHSA-2026:54538 through RHSA-2026:55858) addressing the flaw across RHEL 8, 9, and 10, and Ubuntu issued USN-8641-1. No significant independent researcher commentary or social media controversy was observed beyond routine patch coverage (.NET Blog, GitHub Announcement).