The vulnerability has been identified in ASP.NET Core versions 10.0, 9.0, 8.0, and the Kestrel package for 2.x. An attacker who is already authorized can bypass a security feature by exploiting inconsistent parsing of HTTP requests and responses. Microsoft states there are no known mitigating factors for the HTTP request/response smuggling scenario and strongly recommends patching to the listed fixed versions to prevent the security bypass.
Earlier this month, Microsoft announced the release of .NET 10 Preview 5, delivering updates across multiple components, including ASP.NET Core, .NET MAUI, Windows Presentation Foundation (WPF), and Entity Framework Core.