{"schemaVersion":3,"id":"CVE-2025-55315","aliases":["UBUNTU-CVE-2025-55315","CGA-3mwh-vw9c-f9ww","CGA-4cj2-gq3h-3whh","CGA-4pvr-92mc-7m8v","CGA-8p8q-r9g3-6x59","CGA-ffc9-8jg4-2jh7","CGA-j2rh-g735-m6mj","CGA-j476-mp55-q439","CGA-m3f8-jwq5-2235","CGA-4v98-8jw4-9x6c","GHSA-5rrx-jjjq-q2r5","BIT-aspnet-core-2025-55315"],"status":"published","duplicateOf":null,"title":null,"description":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.","dates":{"published":"2025-10-14T17:00:10.371Z","modified":"2026-02-22T17:24:12.183Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.9,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","exploitability":7.9,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","exploitability":7.9,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","exploitability":7.9,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Nuget","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","exploitability":7.9,"impact":10,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.66526,"percentile":0.99281,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.5830000000000002,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.65943},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.66526,"percentile":0.99281}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.65943,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.66526,"percentile":0.99281}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_N3MES1S_D0897C13CA199E739ECC2B562F466040","name":"D0897C13Ca199E739Ecc2B562F466040","source":"github","url":"https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"52492","name":"ASP.net  8.0.10 - Bypass","source":"exploit-database","url":"https://www.exploit-db.com/exploits/52492","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":null,"platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"webapps","platform":"multiple","file":"exploits/multiple/webapps/52492.py","codes":["CVE-2025-55315"]},"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"The product acts as an intermediary HTTP agent\n         (such as a proxy or firewall) in the data flow between two\n         entities such as a client and server, but it does not\n         interpret malformed HTTP requests or responses in ways that\n         are consistent with how the messages will be processed by\n         those entities that are at the ultimate destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/444.html"}],"affected":[{"vendor":"chainguard","product":"azure-functions-extension-bundles-4","name":"azure-functions-extension-bundles-4","label":"azure-functions-extension-bundles-4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/azure-functions-extension-bundles-4","purlType":"apk","versions":[{"text":"< 4.28.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.28.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-8","name":"dotnet-8","label":"dotnet-8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-8","purlType":"apk","versions":[{"text":"< 8.0.121-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.121-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-9","name":"dotnet-9","label":"dotnet-9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-9","purlType":"apk","versions":[{"text":"< 9.0.111-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.111-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-bootstrap-8","name":"dotnet-bootstrap-8","label":"dotnet-bootstrap-8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-bootstrap-8","purlType":"apk","versions":[{"text":"< 8.0.122-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.122-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dotnet-bootstrap-9","name":"dotnet-bootstrap-9","label":"dotnet-bootstrap-9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dotnet-bootstrap-9","purlType":"apk","versions":[{"text":"< 9.0.112-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.112-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-8","name":"dotnet-8","label":"dotnet-8","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-8","purlType":"apk","versions":[{"text":"< 8.0.121-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.121-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-9","name":"dotnet-9","label":"dotnet-9","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-9","purlType":"apk","versions":[{"text":"< 9.0.111-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.111-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-bootstrap-8","name":"dotnet-bootstrap-8","label":"dotnet-bootstrap-8","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-bootstrap-8","purlType":"apk","versions":[{"text":"< 8.0.122-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.122-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"dotnet-bootstrap-9","name":"dotnet-bootstrap-9","label":"dotnet-bootstrap-9","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/dotnet-bootstrap-9","purlType":"apk","versions":[{"text":"< 9.0.112-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.112-r0","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet10","name":"dotnet10","label":"dotnet10","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet10","purlType":"deb","versions":[{"text":"< 10.0.100-10.0.0-0ubuntu1~24.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 10.0.100-10.0.0~rc2-0ubuntu1~25.10.2","noFixRecorded":false,"fixedIn":null},{"text":"< 10.0.100-10.0.0~rc2-0ubuntu1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.0.100-10.0.0-0ubuntu1~24.04.1 | < 10.0.100-10.0.0~rc2-0ubuntu1~25.10.2 | < 10.0.100-10.0.0~rc2-0ubuntu1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet6","name":"dotnet6","label":"dotnet6","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet6","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet7","name":"dotnet7","label":"dotnet7","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet7","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet8","name":"dotnet8","label":"dotnet8","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet8","purlType":"deb","versions":[{"text":"< 8.0.121-8.0.21-0ubuntu1~22.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.0.121-8.0.21-0ubuntu1~24.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.0.121-8.0.21-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.121-8.0.21-0ubuntu1~22.04.1 | < 8.0.121-8.0.21-0ubuntu1~24.04.1 | < 8.0.121-8.0.21-0ubuntu1~25.10.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dotnet9","name":"dotnet9","label":"dotnet9","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dotnet9","purlType":"deb","versions":[{"text":"< 9.0.111-9.0.10-0ubuntu1~25.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.111-9.0.10-0ubuntu1~25.10.1","eol":null,"hubHref":null},{"vendor":"microsoft","product":"asp.net_core","name":"asp.net core","label":"asp.net_core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.3.0, < 2.3.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.3.0, < 2.3.6 | ≥ 8.0.0, < 8.0.21 | ≥ 9.0.0, < 9.0.10","eol":null,"hubHref":"/vendor/microsoft/aspnet_core"},{"vendor":"microsoft","product":"asp.net core 2.3","name":"ASP.NET Core 2.3","label":"asp.net core 2.3","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.3, < 2.3.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.3, < 2.3.6","eol":null,"hubHref":"/vendor/microsoft/aspnet_core_23"},{"vendor":"microsoft","product":"asp.net core 8.0","name":"ASP.NET Core 8.0","label":"asp.net core 8.0","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0, < 8.0.21","eol":null,"hubHref":"/vendor/microsoft/aspnet_core_80"},{"vendor":"microsoft","product":"asp.net core 9.0","name":"ASP.NET Core 9.0","label":"asp.net core 9.0","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 9.0, < 9.0.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 9.0, < 9.0.10","eol":null,"hubHref":"/vendor/microsoft/aspnet_core_90"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.10","name":"Microsoft Visual Studio 2022 version 17.10","label":"microsoft visual studio 2022 version 17.10","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 17.10.0, < 17.10.20","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 17.10.0, < 17.10.20","eol":null,"hubHref":"/vendor/microsoft/microsoft_visual_studio_2022_version_1710"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.12","name":"Microsoft Visual Studio 2022 version 17.12","label":"microsoft visual studio 2022 version 17.12","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 17.12.0, < 17.12.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 17.12.0, < 17.12.13","eol":null,"hubHref":"/vendor/microsoft/microsoft_visual_studio_2022_version_1712"},{"vendor":"microsoft","product":"microsoft visual studio 2022 version 17.14","name":"Microsoft Visual Studio 2022 version 17.14","label":"microsoft visual studio 2022 version 17.14","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 17.14.0, < 17.14.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 17.14.0, < 17.14.17","eol":null,"hubHref":"/vendor/microsoft/microsoft_visual_studio_2022_version_1714"},{"vendor":"microsoft","product":"visual_studio_2022","name":"visual studio 2022","label":"visual_studio_2022","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 17.10.0, < 17.10.20","noFixRecorded":false,"fixedIn":null},{"text":"≥ 17.12.10, < 17.12.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 17.14.0, < 17.14.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 17.10.0, < 17.10.20 | ≥ 17.12.10, < 17.12.13 | ≥ 17.14.0, < 17.14.17","eol":null,"hubHref":"/vendor/microsoft/visual_studio_2022"},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.linux-arm","name":"Microsoft.AspNetCore.App.Runtime.linux-arm","label":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.linux-arm64","name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","label":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","label":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","label":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","label":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.linux-x64","name":"Microsoft.AspNetCore.App.Runtime.linux-x64","label":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.osx-arm64","name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","label":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.osx-x64","name":"Microsoft.AspNetCore.App.Runtime.osx-x64","label":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.win-arm","name":"Microsoft.AspNetCore.App.Runtime.win-arm","label":"Microsoft.AspNetCore.App.Runtime.win-arm","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.win-arm64","name":"Microsoft.AspNetCore.App.Runtime.win-arm64","label":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.win-x64","name":"Microsoft.AspNetCore.App.Runtime.win-x64","label":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.App.Runtime.win-x86","name":"Microsoft.AspNetCore.App.Runtime.win-x86","label":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86","purlType":"nuget","versions":[{"text":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.21","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107 | ≥ 9.0.0, < 9.0.10 | ≥ 8.0.0, < 8.0.21","eol":null,"hubHref":null},{"vendor":"NuGet","product":"Microsoft.AspNetCore.Server.Kestrel.Core","name":"Microsoft.AspNetCore.Server.Kestrel.Core","label":"Microsoft.AspNetCore.Server.Kestrel.Core","ecosystem":"NuGet","cpePart":null,"purl":"pkg:nuget/Microsoft.AspNetCore.Server.Kestrel.Core","purlType":"nuget","versions":[{"text":"< 2.3.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.3.6","eol":null,"hubHref":null}],"affectedCount":35,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315","hostname":"msrc.microsoft.com","tags":["Vendor Advisory","Patch","REPORT","Advisory","WEB"]},{"url":"https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040","label":"gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040","hostname":"gist.github.com","tags":["Exploit","WEB"]},{"url":"https://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/","label":"andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/","hostname":"andrewlock.net","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2025-55315","label":"ubuntu.com/security/CVE-2025-55315","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55315","label":"www.cve.org/CVERecord?id=CVE-2025-55315","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7822-1","label":"ubuntu.com/security/notices/USN-7822-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-5rrx-jjjq-q2r5","label":"github.com/dotnet/aspnetcore/security/advisories/GHSA-5rrx-jjjq-q2r5","hostname":"github.com","tags":["WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55315","label":"nvd.nist.gov/vuln/detail/CVE-2025-55315","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/dotnet/announcements/issues/371","label":"github.com/dotnet/announcements/issues/371","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/dotnet/aspnetcore","label":"github.com/dotnet/aspnetcore","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["RHBA-2025:20916","RHBA-2025:20993","RHSA-2025:18148","RHSA-2025:18149","RHSA-2025:18150","RHSA-2025:18151","RHSA-2025:18152","RHSA-2025:18153","RHSA-2025:18256","RHSA-2026:9080","RHSA-2026:9205","USN-7822-1"],"duplicates":[],"related":["CGA-CPWC-M5XX-J3G4","USN-7822-1"]},"timeline":[{"kind":"published","date":"2025-10-14T17:00:10.371Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-22T17:24:12.183Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:39:25.216Z","stale":false,"partial":false}}