CVE-2025-55315CWE-444

CVE-2025-55315

Critical · published October 14, 2025

Patch now

High probability of exploitation

CVSS calls it critical at 9.9. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1
9.9
EPSS
67%
Percentile
99.3
In the wild
Unconfirmed
What it is

🚨 A crafty HTTP request could turn your ASP.NET Core application into a security sieve, allowing an authorized attacker to smuggle their way past protections! 🔥 Think of it like a restaurant where a waiter accidentally mixes up two orders — one for the Chef and one for a VIP customer. The mix-up leads to the VIP getting the Chef's secret recipe without anyone noticing the blunder! An attacker can exploit this inconsistency to bypass critical security features, gaining unauthorized access to sensitive data or actions. Imagine the chaos if a customer could suddenly order anything from the kitchen without paying — that's the kind of potential fallout we're talking about!

Put simply

Think of it like a restaurant where a waiter accidentally mixes up two orders — one for the Chef and one for a VIP customer. The mix-up leads to the VIP getting the Chef's secret recipe without anyone noticing the blunder! This vulnerability in ASP.NET Core stems from inconsistent interpretation of HTTP requests, allowing attackers to craft requests that mislead the server and bypass security checks.

What to do

An attacker can exploit this inconsistency to bypass critical security features, gaining unauthorized access to sensitive data or actions. Imagine the chaos if a customer could suddenly order anything from the kitchen without paying — that's the kind of potential fallout we're talking about! To secure your applications, update to the latest ASP.NET Core version as soon as possible. Review your request handling logic and implement strict validation to ensure requests are interpreted correctly and securely. Don't leave any room for slippage! You've got this! Follow these steps, and you'll have your defenses bolstered in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.66526 · 99.3th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2025-10-14T21:15Z
Affected products (6)
ProductVersionsFixed in
microsoft/asp.net_core≥ 2.3.0, < 2.3.62.3.6
microsoft/asp.net_core≥ 8.0.0, < 8.0.218.0.21
microsoft/asp.net_core≥ 9.0.0, < 9.0.109.0.10
microsoft/visual_studio_2022≥ 17.10.0, < 17.10.2017.10.20
microsoft/visual_studio_2022≥ 17.12.10, < 17.12.1317.12.13
microsoft/visual_studio_2022≥ 17.14.0, < 17.14.1717.14.17
References (3)
EPSS history
Timeline
  • 14 OCT 17:00Z
    ASP.NET Security Feature Bypass Vulnerability
    cvelistv5