What’s Vulnerable › Vulnerabilities

CVE-2025-55315: ASP.NET Security Feature Bypass Vulnerability

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 66.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-14 · updated 2026-10-18
• Weakness: CWE-444

Description

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Affected products

• Microsoft .NET Core: from 2.3.0 before 2.3.6; from 8.0.0 before 8.0.21; from 9.0.0 before 9.0.10 — fixed in 2.3.6, 8.0.21, 9.0.10
• Microsoft Visual Studio 2022 version 17.14: from 17.10.0 before 17.10.20; from 17.12.10 before 17.12.13; from 17.14.0 before 17.14.17 — fixed in 17.10.20, 17.12.13, 17.14.17
• Microsoft ASP.NET Core 2.3: from 2.3 before 2.3.6 — fixed in 2.3.6
• Microsoft ASP.NET Core 8.0: from 8.0 before 8.0.21 — fixed in 8.0.21
• Microsoft ASP.NET Core 9.0: from 9.0 before 9.0.10 — fixed in 9.0.10
• Microsoft Visual Studio 2022 version 17.10: from 17.10.0 before 17.10.20 — fixed in 17.10.20
• Microsoft Visual Studio 2022 version 17.14: from 17.12.0 before 17.12.13 — fixed in 17.12.13

How to fix

Upgrade to a fixed version: Microsoft .NET Core 2.3.6, 8.0.21, 9.0.10; Microsoft Visual Studio 2022 version 17.14 17.10.20, 17.12.13, 17.14.17; Microsoft ASP.NET Core 2.3 2.3.6; Microsoft ASP.NET Core 8.0 8.0.21; Microsoft ASP.NET Core 9.0 9.0.10; Microsoft Visual Studio 2022 version 17.10 17.10.20; Microsoft Visual Studio 2022 version 17.14 17.12.13. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315
• https://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/
• https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040

Get alerted when CVE-2025-55315 or the next vulnerability affects your stack