Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2025-55315 — HTTP Request Smuggling in Microsoft Asp.net Core 2.3

CWE-444 — HTTP Request Smuggling11 documents9 sources
Severity
9.9CRITICALNVD
EPSS
1.3%
top 20.36%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
20
Microsoft Asp.net Core 2.3Microsoft Asp.net Core 8.0Microsoft Asp.net Core 9.0+17 more
Timeline
PublishedOct 14
Latest updateApr 6

Description

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:LExploitability: 3.1 | Impact: 6.0

Affected Packages20 packages

▶NVDmicrosoft/asp.net_core2.3.0 — 2.3.6+2
▶CVEListV5microsoft/asp.net_core_2.32.3 — 2.3.6
▶CVEListV5microsoft/asp.net_core_8.08.0 — 8.0.21
▶CVEListV5microsoft/asp.net_core_9.09.0 — 9.0.10
▶NuGetmicrosoft/microsoft.aspnetcore.app.runtime.osx-x6410.0.0-rc.1.25451.107 — 10.0.0-rc.2.25502.107+2

🔴Vulnerability Details

5
OSV
dotnet8, dotnet9, dotnet10 vulnerabilities↗2025-10-16
▶
GHSA
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability↗2025-10-14
▶
CVEList
ASP.NET Security Feature Bypass Vulnerability↗2025-10-14
▶
OSV
CVE-2025-55315: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP↗2025-10-14
▶
OSV
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability↗2025-10-14
▶

💥Exploits & PoCs

1
Exploit-DB
ASP.net 8.0.10 - Bypass↗2026-04-06
▶

📋Vendor Advisories

3
Ubuntu
.NET vulnerabilities↗2025-10-16
▶
Red Hat
dotnet: .NET Security Feature Bypass Vulnerability↗2025-10-15
▶
Microsoft
ASP.NET Security Feature Bypass Vulnerability↗2025-10-14
▶

🕵️Threat Intelligence

1
Bleepingcomputer
QNAP warns of critical ASP.NET flaw in its Windows backup software↗2025-10-27
▶
CVE-2025-55315 — HTTP Request Smuggling in Microsoft | cvebase