CVE-2025-55315

Published Oct 14, 2025

Last updated 6 days ago

ASP.NET Core

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55315 is a security vulnerability affecting ASP.NET Core, specifically the Kestrel web server. It stems from an inconsistent interpretation of HTTP requests, leading to HTTP request smuggling. This vulnerability allows an unauthenticated attacker to smuggle HTTP requests. Successful exploitation of CVE-2025-55315 could allow attackers to bypass security controls, potentially exposing sensitive information like user credentials, modifying files on the server, or even causing a server crash. The vulnerability can be exploited to perform actions such as user spoofing, server-side request forgery, bypassing cross-site request forgery (CSRF) protections, and injection attacks. To mitigate this vulnerability, Microsoft has released security updates for various versions of ASP.NET Core.

Description: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: asp.net_core, visual_studio_2022

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-444

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 38

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3FFD93B1-E2BC-4183-AF00-E8076AE481EB",
            "versionEndExcluding": "2.3.6",
            "versionStartIncluding": "2.3.0"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CF3C03E8-F428-4E48-9E44-C2BFB5063C93",
            "versionEndExcluding": "8.0.21",
            "versionStartIncluding": "8.0.0"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79900862-C5E8-49CC-B3CB-C29E8E105462",
            "versionEndExcluding": "9.0.10",
            "versionStartIncluding": "9.0.0"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D1CC80FE-4DE3-4AC2-AB45-AEEE2A90B3ED",
            "versionEndExcluding": "17.10.20",
            "versionStartIncluding": "17.10.0"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "30CA6B37-C8AE-47E1-AC0C-64A092CD880D",
            "versionEndExcluding": "17.12.13",
            "versionStartIncluding": "17.12.10"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B906E822-E6EF-4890-A100-4BA93187BCD6",
            "versionEndExcluding": "17.14.17",
            "versionStartIncluding": "17.14.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.