CVE-2025-55315: microsoft asp.net_core HTTP Request/Response Smuggling
CVSS: 9.9v3.1CriticalModified
AliasesUBUNTU-CVE-2025-55315CGA-3mwh-vw9c-f9wwCGA-4cj2-gq3h-3whhCGA-4pvr-92mc-7m8vCGA-8p8q-r9g3-6x59CGA-ffc9-8jg4-2jh7CGA-j2rh-g735-m6mjCGA-j476-mp55-q439CGA-m3f8-jwq5-2235CGA-4v98-8jw4-9x6cGHSA-5rrx-jjjq-q2r5BIT-aspnet-core-2025-55315
Published 14-10-2025Last modified 22-02-2026
Vulnerability summary
CVE-2025-55315 is a critical (CVSS 9.9) HTTP Request/Response Smuggling vulnerability in microsoft asp.net_core. EPSS estimates a 66.53% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)EPSS score
66.53%
0%100%
Critical · +0.58 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, exploit-database
Advisory lineage
Upstream 0 · Downstream 12 · Related 2Timeline
- 14-10-2025PublishedVulnerability first disclosed.
- 22-02-2026Last modifiedVulnerability information updated.
Description
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVSS metrics
6 scores · 6 sources · 1 versionCritical 9.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:CSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- OSV · WolfiEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- OSV · ChainguardEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- OSV · NugetEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS trend
Probability
66.53%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+0.58 pp
From 65.94% on 19-09-2026
19-09-202619-10-2026
EPSS score66.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundD0897C13Ca199E739Ecc2B562F466040
Maturity: poc
ASP.net 8.0.10 - Bypass
Maturity: poc
Weaknesses
CWE · root causeAffected systems
NuGet13 products
- Microsoft.AspNetCore.App.Runtime.linux-arm≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21
- Microsoft.AspNetCore.App.Runtime.linux-arm64≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21
Microsoft8 products
- asp.net_core≥ 2.3.0, < 2.3.6 | ≥ 8.0.0, < 8.0.21 | ≥ 9.0.0, < 9.0.10
- asp.net core 2.3≥ 2.3, < 2.3.6
- asp.net core 8.0≥ 8.0, < 8.0.21
- asp.net core 9.0≥ 9.0, < 9.0.10
- microsoft visual studio 2022 version 17.10≥ 17.10.0, < 17.10.20
Chainguard5 products
- azure-functions-extension-bundles-4< 4.28.0-r1
- dotnet-8< 8.0.121-r0
- dotnet-9< 9.0.111-r0
- dotnet-bootstrap-8< 8.0.122-r0
- dotnet-bootstrap-9< 9.0.112-r0
Ubuntu5 products
- dotnet10< 10.0.100-10.0.0-0ubuntu1~24.04.1 | < 10.0.100-10.0.0~rc2-0ubuntu1~25.10.2 | < 10.0.100-10.0.0~rc2-0ubuntu1
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.121-8.0.21-0ubuntu1~22.04.1 | < 8.0.121-8.0.21-0ubuntu1~24.04.1 | < 8.0.121-8.0.21-0ubuntu1~25.10.1
- dotnet9< 9.0.111-9.0.10-0ubuntu1~25.10.1
Wolfi4 products
- dotnet-8< 8.0.121-r0
- dotnet-9< 9.0.111-r0
- dotnet-bootstrap-8< 8.0.122-r0
- dotnet-bootstrap-9< 9.0.112-r0
5 vendors · 35 products
References
10 links
- github.com/dotnet/aspnetcorePACKAGE