Critical .NET Vulnerabilities Discovered Affecting Multiple Versions

Multiple vulnerabilities were identified in .NET, impacting versions 8.0 and 10.0. Miha Zupan reported a flaw (CVE-2026-62899) allowing request smuggling through improper HTTP request interpretation. Ivan Demchuk found a vulnerability (CVE-2026-62900) that could lead to sensitive information disclosure due to improper handling of data. Kevin Gosse discovered two additional issues: one (CVE-2026-62901) that could cause denial of service through unchecked loop conditions and another (CVE-2026-62909) that could elevate privileges due to inadequate error checking. All vulnerabilities were published on 2026-08-11, and users are advised to update their systems to mitigate risks.

Key Points: • Four critical vulnerabilities in .NET were disclosed, affecting versions 8.0 and 10.0. • CVE-2026-62899 allows request smuggling, while CVE-2026-62900 could lead to sensitive data exposure. • Users are urged to update their systems to the latest versions to address these vulnerabilities.