Critical · published October 14, 2025
CVSS calls it critical at 9.9. It sits in the 99.3th percentile for exploit probability.
🚨 A crafty HTTP request could turn your ASP.NET Core application into a security sieve, allowing an authorized attacker to smuggle their way past protections! 🔥 Think of it like a restaurant where a waiter accidentally mixes up two orders — one for the Chef and one for a VIP customer. The mix-up leads to the VIP getting the Chef's secret recipe without anyone noticing the blunder! An attacker can exploit this inconsistency to bypass critical security features, gaining unauthorized access to sensitive data or actions. Imagine the chaos if a customer could suddenly order anything from the kitchen without paying — that's the kind of potential fallout we're talking about!
Think of it like a restaurant where a waiter accidentally mixes up two orders — one for the Chef and one for a VIP customer. The mix-up leads to the VIP getting the Chef's secret recipe without anyone noticing the blunder! This vulnerability in ASP.NET Core stems from inconsistent interpretation of HTTP requests, allowing attackers to craft requests that mislead the server and bypass security checks.
An attacker can exploit this inconsistency to bypass critical security features, gaining unauthorized access to sensitive data or actions. Imagine the chaos if a customer could suddenly order anything from the kitchen without paying — that's the kind of potential fallout we're talking about! To secure your applications, update to the latest ASP.NET Core version as soon as possible. Review your request handling logic and implement strict validation to ensure requests are interpreted correctly and securely. Don't leave any room for slippage! You've got this! Follow these steps, and you'll have your defenses bolstered in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/asp.net_core | ≥ 2.3.0, < 2.3.6 | 2.3.6 |
| microsoft/asp.net_core | ≥ 8.0.0, < 8.0.21 | 8.0.21 |
| microsoft/asp.net_core | ≥ 9.0.0, < 9.0.10 | 9.0.10 |
| microsoft/visual_studio_2022 | ≥ 17.10.0, < 17.10.20 | 17.10.20 |
| microsoft/visual_studio_2022 | ≥ 17.12.10, < 17.12.13 | 17.12.13 |
| microsoft/visual_studio_2022 | ≥ 17.14.0, < 17.14.17 | 17.14.17 |