Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an
    unauthorized attacker to bypass a security feature over a network. (CVE-2026-62899)

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by a vulnerability as referenced in the vendor advisory.

  - .NET Elevation of Privilege Vulnerability (CVE-2026-58641, CVE-2026-62871, CVE-2026-62886, CVE-2026-62909)

  - .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

  - .NET Information Disclosure Vulnerability (CVE-2026-62900, CVE-2026-62902)

  - .NET Denial of Service Vulnerability (CVE-2026-62901)

  - .NET Core Remote Code Execution Vulnerability (CVE-2026-70354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - .NET Elevation of Privilege Vulnerability (CVE-2026-58641, CVE-2026-62871, CVE-2026-62886, CVE-2026-62909)

  - .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

  - .NET Information Disclosure Vulnerability (CVE-2026-62900, CVE-2026-62902)

  - .NET Denial of Service Vulnerability (CVE-2026-62901)

  - .NET Core Remote Code Execution Vulnerability (CVE-2026-70354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
445853	SCA: security update for Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-musl-x64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-arm64, Microsoft.NETCore.App.Runtime.osx-x64 (GHSA-r6mh-95jw-g7qg)	Tenable Cloud Security	SCA Checks	Local	medium
445853	SCA: security update for Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-musl-x64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-arm64, Microsoft.NETCore.App.Runtime.osx-x64 (GHSA-r6mh-95jw-g7qg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
334621	Security Update for Microsoft .NET Core SDK (August 2026)	Nessus	Windows	Local	high
334610	Security Update for Microsoft .NET Core (August 2026)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2026-62899

medium

Tenable Plugins

medium

medium

high

high