CVE-2025-55315
published 2025-10-14CVE-2025-55315: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature…
PriorityP181critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAL
EXPLOIT
EPSS
65.84%
99.2th percentile
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | asp.net_core | >= 2.3.0 < 2.3.6 | 2.3.6 |
| microsoft | asp.net_core | >= 8.0.0 < 8.0.21 | 8.0.21 |
| microsoft | asp.net_core | >= 9.0.0 < 9.0.10 | 9.0.10 |
| microsoft | asp.net_core_2.3 | >= 2.3 < 2.3.6 | 2.3.6 |
| microsoft | asp.net_core_8.0 | >= 8.0 < 8.0.21 | 8.0.21 |
| microsoft | asp.net_core_9.0 | >= 9.0 < 9.0.10 | 9.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 10.0.0-rc.1.25451.107 < 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 8.0.0 < 8.0.21 | 8.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm | >= 9.0.0 < 9.0.10 | 9.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 10.0.0-rc.1.25451.107 < 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 8.0.0 < 8.0.21 | 8.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-arm64 | >= 9.0.0 < 9.0.10 | 9.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | >= 10.0.0-rc.1.25451.107 < 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | >= 8.0.0 < 8.0.21 | 8.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm | >= 9.0.0 < 9.0.10 | 9.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 10.0.0-rc.1.25451.107 < 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 8.0.0 < 8.0.21 | 8.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-arm64 | >= 9.0.0 < 9.0.10 | 9.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 10.0.0-rc.1.25451.107 < 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 8.0.0 < 8.0.21 | 8.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-musl-x64 | >= 9.0.0 < 9.0.10 | 9.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 10.0.0-rc.1.25451.107 < 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 8.0.0 < 8.0.21 | 8.0.21 |
| microsoft | microsoft.aspnetcore.app.runtime.linux-x64 | >= 9.0.0 < 9.0.10 | 9.0.10 |
| microsoft | microsoft.aspnetcore.app.runtime.osx-arm64 | >= 10.0.0-rc.1.25451.107 < 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
LF-only chunk termination: b"1\nx\n0\n\n"
bytes↗
Smuggled chunk extension pattern: b"1;ext\nx\n"
- →Detect HTTP request smuggling fingerprint: chunked body using LF-only line endings (bare \n instead of \r\n) in Kestrel — a 400 Bad Request response indicates a patched server; absence of 400 on such a request indicates a vulnerable one. ↗
- →Detect WAF bypass attempt via mixed-case Transfer-Encoding header value 'chUnKEd' in HTTP requests to ASP.NET Core / Kestrel endpoints. ↗
- →Detect HTTP request smuggling attack pattern: POST request with chunked encoding containing a smuggled GET /admin request with X-Bypass header appended after the terminal chunk. ↗
- →Detect SSRF exploitation attempts targeting AWS instance metadata service (169.254.169.254) via smuggled HTTP requests through Kestrel. ↗
- →Look for the presence of the exploit report directory 'kestrel_desync_reports' on attacker-controlled or compromised systems as an artifact of exploit tool execution. ↗
- ·The exploit's CVSS score (9.8, PR:N) differs from the NVD/Wiz-reported score (9.9) and requires an authenticated attacker per the official advisory; the exploit author notes it was tested only in a lab environment on localhost. ↗
- ·For ASP.NET Core 2.x apps, patching requires updating the NuGet package reference for Microsoft.AspNet.Server.Kestrel.Core to version 2.3.6 and recompiling/redeploying — a runtime update alone is insufficient. ↗
- ·Self-contained and single-file ASP.NET Core applications bundle the runtime and require recompilation and redeployment after installing the .NET update — a system-level patch alone does not protect them. ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
ghsa9.9CRITICAL
osv9.9CRITICAL
vendor_msrc9.9CRITICAL
vendor_redhat9.9CRITICAL
vendor_ubuntu7.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
dotnet8, dotnet9, dotnet10 vulnerabilities
osv·2025-10-16·CVSS 7.3
CVE-2025-55247 [HIGH] dotnet8, dotnet9, dotnet10 vulnerabilities
dotnet8, dotnet9, dotnet10 vulnerabilities
It was discovered that .NET did not properly handle the creation of temporary
build time directories. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-55247)
It was discovered that .NET did not properly establish TLS sessions for
SMTP server connections. An attacker could use this issue to cause .NET
to use unencrypted connections. This issue only affects .NET versions 8.0
and 9.0. (CVE-2025-55248)
It was discovered that .NET inconsistently interpreted certain http
requests. An attacker could possibly use this to bypass a security feature
over a network. (CVE-2025-55315)
GHSA
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
ghsa·2025-10-14·CVSS 9.9
CVE-2025-55315 [CRITICAL] CWE-444 Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
# Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 10.0 , ASP.NET Core 9.0 , ASP.NET Core 8.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
## Discussion
Discussion for this issue can be found at https://github.com/dotnet/announcements/issues/371
### Mitigation factor
OSV
CVE-2025-55315: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP
osv·2025-10-14·CVSS 9.9
CVE-2025-55315 [CRITICAL] CVE-2025-55315: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
OSV
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
osv·2025-10-14·CVSS 9.9
CVE-2025-55315 [CRITICAL] Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
# Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 10.0 , ASP.NET Core 9.0 , ASP.NET Core 8.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
## Discussion
Discussion for this issue can be found at https://github.com/dotnet/announcements/issues/371
### Mitigation factor
Ubuntu
.NET vulnerabilities
vendor_ubuntu·2025-10-16·CVSS 7.3
CVE-2025-55248 [HIGH] .NET vulnerabilities
Title: .NET vulnerabilities
Summary: Several security issues were fixed in .NET
It was discovered that .NET did not properly handle the creation of temporary
build time directories. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-55247)
It was discovered that .NET did not properly establish TLS sessions for
SMTP server connections. An attacker could use this issue to cause .NET
to use unencrypted connections. This issue only affects .NET versions 8.0
and 9.0. (CVE-2025-55248)
It was discovered that .NET inconsistently interpreted certain http
requests. An attacker could possibly use this to bypass a security feature
over a network. (CVE-2025-55315)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
dotnet: .NET Security Feature Bypass Vulnerability
vendor_redhat·2025-10-15·CVSS 9.9
CVE-2025-55315 [CRITICAL] CWE-444 dotnet: .NET Security Feature Bypass Vulnerability
dotnet: .NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended forwarding of request data.
Statement: The Red Hat Product Security team has assessed this issue as Important. An authorized network attacker can exploit inconsistent HTTP request parsing in ASP.NET Core to bypass security controls (HTTP request smuggling), potentially exposing or
Microsoft
ASP.NET Security Feature Bypass Vulnerability
vendor_msrc·2025-10-14·CVSS 9.9
CVE-2025-55315 [CRITICAL] CWE-444 ASP.NET Security Feature Bypass Vulnerability
ASP.NET Security Feature Bypass Vulnerability
Description: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
FAQ: How could an attacker exploit the vulnerability?
An authenticated attacker could exploit the vulnerability by sending a malicious http request to the web server.
FAQ: According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), and some loss of availability (A:L). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could view sensitive information such as other user's credentials (Confidentiality) and make changes to fi
No detection rules found.
Bleepingcomputer
Microsoft releases emergency patches for critical ASP.NET flaw
blogs_bleepingcomputer·2026-04-22·CVSS 9.9
CVE-2025-55315 [CRITICAL] Microsoft releases emergency patches for critical ASP.NET flaw
## Microsoft releases emergency patches for critical ASP.NET flaw
## Sergiu Gatlan
"A regression in the Microsoft.AspNetCore.DataProtection 10.0.0-10.0.6 NuGet packages causes the managed authenticated encryptor to compute its HMAC validation tag over the wrong bytes of the payload and then discard the computed hash in some cases," Microsoft says in the .NET 10.0.7 release notes.
"In these cases, the broken validation could allow an attacker to forge payloads that pass DataProtection's authenticity checks, and to decrypt previously-protected payloads in auth cookies, antiforgery tokens, TempData, OIDC state, etc.
"If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed toke
Bleepingcomputer
QNAP warns of critical ASP.NET flaw in its Windows backup software
blogs_bleepingcomputer·2025-10-27·CVSS 9.9
CVE-2025-55315 [CRITICAL] QNAP warns of critical ASP.NET flaw in its Windows backup software
## QNAP warns of critical ASP.NET flaw in its Windows backup software
## Sergiu Gatlan
QNAP warned customers to patch a critical ASP.NET Core vulnerability that also impacts the company's NetBak PC Agent, a Windows utility for backing up data to a QNAP network-attached storage (NAS) device.
Tracked as CVE-2025-55315 , this security bypass flaw was found in the Kestrel ASP.NET Core web server and enables attackers with low privileges to hijack other users' credentials or bypass front-end security controls via HTTP request smuggling .
"NetBak PC Agent installs and depends on Microsoft ASP.NET Core components during setup. Therefore, computers running NetBak PC Agent may contain an affected version of ASP.NET Core if the system has not been updated," QNAP said .
"QNAP strongly recommends
Checkpoint
20th October – Threat Intelligence Report
blogs_checkpoint·2025-10-20·CVSS 9.8
CVE-2025-61882 [CRITICAL] 20th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th October, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
F5 has disclosed a cyber attack, reportedly carried out by a nation-state actor with long-term, persistent access to critical product development environments. The attacker exfiltrated files that included portions of BIG-IP source code and information about undisclosed vulnerabilities. Some stolen files also contained dat
Bleepingcomputer
Microsoft fixes highest-severity ASP.NET Core flaw ever
blogs_bleepingcomputer·2025-10-17·CVSS 9.9
[CRITICAL] Microsoft fixes highest-severity ASP.NET Core flaw ever
## Microsoft fixes highest-severity ASP.NET Core flaw ever
## Sergiu Gatlan
To ensure that their ASP.NET Core applications are secured against potential attacks, Microsoft advises developers and users to take the following measures:
If running .NET 8 or later, install the .NET update from Microsoft Update, then restart your application or reboot the machine.
If running .NET 2.3, update the package reference for Microsoft.AspNet.Server.Kestrel.Core to 2.3.6, then recompile the application, and redeploy.
If running a self-contained/single-file application, install the .NET update, recompile, and redeploy.
To address the vulnerability, Microsoft has released security updates for Microsoft Visual Studio 2022, ASP.NET Core 2.3, ASP.NET Core 8.0, and ASP.NET Core 9.0, as well as the Micros
Qualys
Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review | Qualys
blogs_qualys·2025-10-14
Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for October 2025
- Adobe Patches for October 2025
- Zero-day Vulnerabilities Patched in October Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in October Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response with TruRisk Eliminate
- Automating Risk Elimination and Accelerating Response: Meet Agent Sara
- EVALUATE Vendor-Suggested Mitigation withPolicy Audit
- Qualys Monthly Webinar Series
As cybersecurity threats evolve, Microsoft’s October 2025 Patch Tuesday delivers one of the most comprehensive security updates of the year. Here’s a quick breakdown of what you need t
Qualys
Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review
blogs_qualys·2025-10-14
Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for October 2025
Adobe Patches for October 2025
Zero-day Vulnerabilities Patched in October Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in October Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response with TruRisk Eliminate
Automating Risk Elimination and Accelerating Response: Meet Agent Sara
EVALUATE Vendor-Suggested Mitigation withPolicy Audit
Qualys Monthly Webinar Series
As cybersecurity threats evolve, Microsoft’s October 2025 Patch Tuesday delivers one of the most comprehensive security updates of the year. Here’s a quick breakdown of what you need to know.
## Mi
Bleepingcomputer
Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
blogs_bleepingcomputer·2025-10-14·CVSS 7.8
[HIGH] Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Lawrence Abrams
80 Elevation of Privilege Vulnerabilities
11 Security Feature Bypass Vulnerabilities
31 Remote Code Execution Vulnerabilities
28 Information Disclosure Vulnerabilities
11 Denial of Service Vulnerabilities
10 Spoofing Vulnerabilities
When BleepingComputer reports on the Patch Tuesday security updates, we only count those released today by Microsoft. Therefore, the number of flaws does not include those fixed in Azure, Mariner, Microsoft Edge, and other vulnerabilities earlier this month.
Notably, Windows 10 reaches the end of support today , with this being the last Patch Tuesday where Microsoft provides free security updates to the venerable operating system.
To continue receiving security upd
Wiz
CVE-2026-21257 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-21257 [MEDIUM] CVE-2026-21257 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21257 :
Visual Studio 2022 vulnerability analysis and mitigation
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.
Source : NVD
## 8
Score
Published February 10, 2026
Severity HIGH
CNA Score 8.0
Affected Technologies
Visual Studio 2022
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:microsoft:visual_studio_2022
Sources
Windows Severity HIGH Has Fix Added at: Feb 11, 2026
Windows Severity HIGH Has Fix Added at: Feb 12, 2026
## Get a CVE risk assessme
Wiz
CVE-2026-21256 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-21256 [MEDIUM] CVE-2026-21256 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21256 :
Visual Studio 2022 vulnerability analysis and mitigation
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.
Source : NVD
## 8.8
Score
Published February 10, 2026
Severity HIGH
CNA Score 8.8
Affected Technologies
Visual Studio 2022
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:microsoft:visual_studio_2022
Sources
Windows Severity HIGH Has Fix Added at: Feb 11, 2026
Windows Severity HIGH Has Fix Added at: Feb 12, 2026
## Get a CVE risk assessment
Bugzilla
CVE-2025-55315 dotnet: .NET Security Feature Bypass Vulnerability
bugzilla·2025-10-10·CVSS 9.9
CVE-2025-55315 [CRITICAL] CVE-2025-55315 dotnet: .NET Security Feature Bypass Vulnerability
CVE-2025-55315 dotnet: .NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response
smuggling') in ASP.NET Core allows an authorized attacker to bypass a
security feature over a network.
Affected versions:
.NET 8.0 (that's the RHEL dotnet8.0 package)
.NET 9.0 (that's the RHEL dotnet9.0 package)
.NET 10.0 (that's the RHEL dotnet10.0 package)
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2025:18148 https://access.redhat.com/errata/RHSA-2025:18148
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:18149 https://access.redhat.com/errata/RHSA-2025:18149
---
This issue has been addressed in the following products:
Red Hat En
2025-10-14
Published