01 Record

CVE-2025-55315

ASP.NET Security Feature Bypass Vulnerability

CriticalPUBLISHEDCNA: microsoft

CNA base score9.9 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C

View raw JSON

02 Description

ASP.NET Security Feature Bypass Vulnerability

03 Exploitation and scoring

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

66.52% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 99.2% of scored records. A rank, not a probability.

NVD base score

9.9 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

NVD analysis status

Modified. NVD last modified this record on 2026-10-18.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-10-14 17:00Z1 YR AGO

Last updated

2026-02-22 17:24Z8 MO AGO

Reserved

2025-08-12

Assigning CNA

microsoft

Record state

PUBLISHED

Severity

Critical (CVSS 9.9)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C

Weaknesses

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')Base

Data version

5.2

Document digest

ba58a1ba496c33aa59b18a4e1364406e807661ef96d0ffcd8a1ad9a5d44bfa6d

05 Affected products

VendorProductVersionsPlatforms

MicrosoftASP.NET Core 2.32.3 to < 2.3.6—

MicrosoftASP.NET Core 8.08.0 to < 8.0.21—

MicrosoftASP.NET Core 9.09.0 to < 9.0.10—

MicrosoftMicrosoft Visual Studio 2022 version 17.1017.10.0 to < 17.10.20—

MicrosoftMicrosoft Visual Studio 2022 version 17.1217.12.0 to < 17.12.13—

MicrosoftMicrosoft Visual Studio 2022 version 17.1417.14.0 to < 17.14.17—

06 References

msrc.microsoft.comASP.NET Security Feature Bypass Vulnerabilityhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315vendor-advisorypatch
gist.github.comhttps://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040exploit
andrewlock.nethttps://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/

07 Fixed in

AlmaLinux 8

aspnetcore-runtime-8.0
Fixed in 8.0.21-1.el8_10
aspnetcore-runtime-9.0
Fixed in 9.0.10-1.el8_10
aspnetcore-runtime-dbg-8.0
Fixed in 8.0.21-1.el8_10
aspnetcore-runtime-dbg-9.0
Fixed in 9.0.10-1.el8_10
aspnetcore-targeting-pack-8.0
Fixed in 8.0.21-1.el8_10
aspnetcore-targeting-pack-9.0
Fixed in 9.0.10-1.el8_10
dotnet
Fixed in 9.0.111-1.el8_10
dotnet-apphost-pack-8.0
Fixed in 8.0.21-1.el8_10
dotnet-apphost-pack-9.0
Fixed in 9.0.10-1.el8_10
dotnet-host
Fixed in 9.0.10-1.el8_10
dotnet-hostfxr-8.0
Fixed in 8.0.21-1.el8_10
dotnet-hostfxr-9.0
Fixed in 9.0.10-1.el8_10
dotnet-runtime-8.0
Fixed in 8.0.21-1.el8_10
dotnet-runtime-9.0
Fixed in 9.0.10-1.el8_10
dotnet-runtime-dbg-8.0
Fixed in 8.0.21-1.el8_10
dotnet-runtime-dbg-9.0
Fixed in 9.0.10-1.el8_10
dotnet-sdk-8.0
Fixed in 8.0.121-1.el8_10
dotnet-sdk-8.0-source-built-artifacts
Fixed in 8.0.121-1.el8_10
dotnet-sdk-9.0
Fixed in 9.0.111-1.el8_10
dotnet-sdk-9.0-source-built-artifacts
Fixed in 9.0.111-1.el8_10
dotnet-sdk-aot-9.0
Fixed in 9.0.111-1.el8_10
dotnet-sdk-dbg-8.0
Fixed in 8.0.121-1.el8_10
dotnet-sdk-dbg-9.0
Fixed in 9.0.111-1.el8_10
dotnet-targeting-pack-8.0
Fixed in 8.0.21-1.el8_10
dotnet-targeting-pack-9.0
Fixed in 9.0.10-1.el8_10
dotnet-templates-8.0
Fixed in 8.0.121-1.el8_10
dotnet-templates-9.0
Fixed in 9.0.111-1.el8_10
netstandard-targeting-pack-2.1
Fixed in 9.0.111-1.el8_10

AlmaLinux 9

aspnetcore-runtime-8.0
Fixed in 8.0.21-1.el9_6
aspnetcore-runtime-9.0
Fixed in 9.0.10-1.el9_6
aspnetcore-runtime-dbg-8.0
Fixed in 8.0.21-1.el9_6
aspnetcore-runtime-dbg-9.0
Fixed in 9.0.10-1.el9_6
aspnetcore-targeting-pack-8.0
Fixed in 8.0.21-1.el9_6
aspnetcore-targeting-pack-9.0
Fixed in 9.0.10-1.el9_6
dotnet-apphost-pack-8.0
Fixed in 8.0.21-1.el9_6
dotnet-apphost-pack-9.0
Fixed in 9.0.10-1.el9_6
dotnet-host
Fixed in 9.0.10-1.el9_6
dotnet-hostfxr-8.0
Fixed in 8.0.21-1.el9_6
dotnet-hostfxr-9.0
Fixed in 9.0.10-1.el9_6
dotnet-runtime-8.0
Fixed in 8.0.21-1.el9_6
dotnet-runtime-9.0
Fixed in 9.0.10-1.el9_6
dotnet-runtime-dbg-8.0
Fixed in 8.0.21-1.el9_6
dotnet-runtime-dbg-9.0
Fixed in 9.0.10-1.el9_6
dotnet-sdk-8.0
Fixed in 8.0.121-1.el9_6
dotnet-sdk-8.0-source-built-artifacts
Fixed in 8.0.121-1.el9_6
dotnet-sdk-9.0
Fixed in 9.0.111-1.el9_6
dotnet-sdk-9.0-source-built-artifacts
Fixed in 9.0.111-1.el9_6
dotnet-sdk-aot-9.0
Fixed in 9.0.111-1.el9_6
dotnet-sdk-dbg-8.0
Fixed in 8.0.121-1.el9_6
dotnet-sdk-dbg-9.0
Fixed in 9.0.111-1.el9_6
dotnet-targeting-pack-8.0
Fixed in 8.0.21-1.el9_6
dotnet-targeting-pack-9.0
Fixed in 9.0.10-1.el9_6
dotnet-templates-8.0
Fixed in 8.0.121-1.el9_6
dotnet-templates-9.0
Fixed in 9.0.111-1.el9_6
netstandard-targeting-pack-2.1
Fixed in 9.0.111-1.el9_6

AlmaLinux 10

aspnetcore-runtime-8.0
Fixed in 8.0.21-1.el10_0
aspnetcore-runtime-9.0
Fixed in 9.0.10-1.el10_0
aspnetcore-runtime-dbg-8.0
Fixed in 8.0.21-1.el10_0
aspnetcore-runtime-dbg-9.0
Fixed in 9.0.10-1.el10_0
aspnetcore-targeting-pack-8.0
Fixed in 8.0.21-1.el10_0
aspnetcore-targeting-pack-9.0
Fixed in 9.0.10-1.el10_0
dotnet-apphost-pack-8.0
Fixed in 8.0.21-1.el10_0
dotnet-apphost-pack-9.0
Fixed in 9.0.10-1.el10_0
dotnet-host
Fixed in 9.0.10-1.el10_0
dotnet-hostfxr-8.0
Fixed in 8.0.21-1.el10_0
dotnet-hostfxr-9.0
Fixed in 9.0.10-1.el10_0
dotnet-runtime-8.0
Fixed in 8.0.21-1.el10_0
dotnet-runtime-9.0
Fixed in 9.0.10-1.el10_0
dotnet-runtime-dbg-8.0
Fixed in 8.0.21-1.el10_0
dotnet-runtime-dbg-9.0
Fixed in 9.0.10-1.el10_0
dotnet-sdk-8.0
Fixed in 8.0.121-1.el10_0
dotnet-sdk-8.0-source-built-artifacts
Fixed in 8.0.121-1.el10_0
dotnet-sdk-9.0
Fixed in 9.0.111-1.el10_0
dotnet-sdk-9.0-source-built-artifacts
Fixed in 9.0.111-1.el10_0
dotnet-sdk-aot-9.0
Fixed in 9.0.111-1.el10_0
dotnet-sdk-dbg-8.0
Fixed in 8.0.121-1.el10_0
dotnet-sdk-dbg-9.0
Fixed in 9.0.111-1.el10_0
dotnet-targeting-pack-8.0
Fixed in 8.0.21-1.el10_0
dotnet-targeting-pack-9.0
Fixed in 9.0.10-1.el10_0
dotnet-templates-8.0
Fixed in 8.0.121-1.el10_0
dotnet-templates-9.0
Fixed in 9.0.111-1.el10_0
netstandard-targeting-pack-2.1
Fixed in 9.0.111-1.el10_0

CloudLinux 8

aspnetcore-runtime-8.0
Fixed in 8.0.21-1.el8_10
aspnetcore-runtime-9.0
Fixed in 9.0.10-1.el8_10
aspnetcore-runtime-dbg-8.0
Fixed in 8.0.21-1.el8_10
aspnetcore-runtime-dbg-9.0
Fixed in 9.0.10-1.el8_10
aspnetcore-targeting-pack-8.0
Fixed in 8.0.21-1.el8_10
aspnetcore-targeting-pack-9.0
Fixed in 9.0.10-1.el8_10
dotnet
Fixed in 9.0.111-1.el8_10
dotnet-apphost-pack-8.0
Fixed in 8.0.21-1.el8_10
dotnet-apphost-pack-9.0
Fixed in 9.0.10-1.el8_10
dotnet-host
Fixed in 9.0.10-1.el8_10
dotnet-hostfxr-8.0
Fixed in 8.0.21-1.el8_10
dotnet-hostfxr-9.0
Fixed in 9.0.10-1.el8_10
dotnet-runtime-8.0
Fixed in 8.0.21-1.el8_10
dotnet-runtime-9.0
Fixed in 9.0.10-1.el8_10
dotnet-runtime-dbg-8.0
Fixed in 8.0.21-1.el8_10
dotnet-runtime-dbg-9.0
Fixed in 9.0.10-1.el8_10
dotnet-sdk-8.0
Fixed in 8.0.121-1.el8_10
dotnet-sdk-8.0-source-built-artifacts
Fixed in 8.0.121-1.el8_10
dotnet-sdk-9.0
Fixed in 9.0.111-1.el8_10
dotnet-sdk-9.0-source-built-artifacts
Fixed in 9.0.111-1.el8_10
dotnet-sdk-aot-9.0
Fixed in 9.0.111-1.el8_10
dotnet-sdk-dbg-8.0
Fixed in 8.0.121-1.el8_10
dotnet-sdk-dbg-9.0
Fixed in 9.0.111-1.el8_10
dotnet-targeting-pack-8.0
Fixed in 8.0.21-1.el8_10
dotnet-targeting-pack-9.0
Fixed in 9.0.10-1.el8_10
dotnet-templates-8.0
Fixed in 8.0.121-1.el8_10
dotnet-templates-9.0
Fixed in 9.0.111-1.el8_10
netstandard-targeting-pack-2.1
Fixed in 9.0.111-1.el8_10

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

CloudLinux 9

aspnetcore-runtime-8.0
Fixed in 8.0.21-1.el9_6
aspnetcore-runtime-9.0
Fixed in 9.0.10-1.el9_6
aspnetcore-runtime-dbg-8.0
Fixed in 8.0.21-1.el9_6
aspnetcore-runtime-dbg-9.0
Fixed in 9.0.10-1.el9_6
aspnetcore-targeting-pack-8.0
Fixed in 8.0.21-1.el9_6
aspnetcore-targeting-pack-9.0
Fixed in 9.0.10-1.el9_6
dotnet-apphost-pack-8.0
Fixed in 8.0.21-1.el9_6
dotnet-apphost-pack-9.0
Fixed in 9.0.10-1.el9_6
dotnet-host
Fixed in 9.0.10-1.el9_6
dotnet-hostfxr-8.0
Fixed in 8.0.21-1.el9_6
dotnet-hostfxr-9.0
Fixed in 9.0.10-1.el9_6
dotnet-runtime-8.0
Fixed in 8.0.21-1.el9_6
dotnet-runtime-9.0
Fixed in 9.0.10-1.el9_6
dotnet-runtime-dbg-8.0
Fixed in 8.0.21-1.el9_6
dotnet-runtime-dbg-9.0
Fixed in 9.0.10-1.el9_6
dotnet-sdk-8.0
Fixed in 8.0.121-1.el9_6
dotnet-sdk-8.0-source-built-artifacts
Fixed in 8.0.121-1.el9_6
dotnet-sdk-9.0
Fixed in 9.0.111-1.el9_6
dotnet-sdk-9.0-source-built-artifacts
Fixed in 9.0.111-1.el9_6
dotnet-sdk-aot-9.0
Fixed in 9.0.111-1.el9_6
dotnet-sdk-dbg-8.0
Fixed in 8.0.121-1.el9_6
dotnet-sdk-dbg-9.0
Fixed in 9.0.111-1.el9_6
dotnet-targeting-pack-8.0
Fixed in 8.0.21-1.el9_6
dotnet-targeting-pack-9.0
Fixed in 9.0.10-1.el9_6
dotnet-templates-8.0
Fixed in 8.0.121-1.el9_6
dotnet-templates-9.0
Fixed in 9.0.111-1.el9_6
netstandard-targeting-pack-2.1
Fixed in 9.0.111-1.el9_6

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

CloudLinux 10

aspnetcore-runtime-8.0
Fixed in 8.0.21-1.el10_0
aspnetcore-runtime-9.0
Fixed in 9.0.10-1.el10_0
aspnetcore-runtime-dbg-8.0
Fixed in 8.0.21-1.el10_0
aspnetcore-runtime-dbg-9.0
Fixed in 9.0.10-1.el10_0
aspnetcore-targeting-pack-8.0
Fixed in 8.0.21-1.el10_0
aspnetcore-targeting-pack-9.0
Fixed in 9.0.10-1.el10_0
dotnet-apphost-pack-8.0
Fixed in 8.0.21-1.el10_0
dotnet-apphost-pack-9.0
Fixed in 9.0.10-1.el10_0
dotnet-host
Fixed in 9.0.10-1.el10_0
dotnet-hostfxr-8.0
Fixed in 8.0.21-1.el10_0
dotnet-hostfxr-9.0
Fixed in 9.0.10-1.el10_0
dotnet-runtime-8.0
Fixed in 8.0.21-1.el10_0
dotnet-runtime-9.0
Fixed in 9.0.10-1.el10_0
dotnet-runtime-dbg-8.0
Fixed in 8.0.21-1.el10_0
dotnet-runtime-dbg-9.0
Fixed in 9.0.10-1.el10_0
dotnet-sdk-8.0
Fixed in 8.0.121-1.el10_0
dotnet-sdk-8.0-source-built-artifacts
Fixed in 8.0.121-1.el10_0
dotnet-sdk-9.0
Fixed in 9.0.111-1.el10_0
dotnet-sdk-9.0-source-built-artifacts
Fixed in 9.0.111-1.el10_0
dotnet-sdk-aot-9.0
Fixed in 9.0.111-1.el10_0
dotnet-sdk-dbg-8.0
Fixed in 8.0.121-1.el10_0
dotnet-sdk-dbg-9.0
Fixed in 9.0.111-1.el10_0
dotnet-targeting-pack-8.0
Fixed in 8.0.21-1.el10_0
dotnet-targeting-pack-9.0
Fixed in 9.0.10-1.el10_0
dotnet-templates-8.0
Fixed in 8.0.121-1.el10_0
dotnet-templates-9.0
Fixed in 9.0.111-1.el10_0
netstandard-targeting-pack-2.1
Fixed in 9.0.111-1.el10_0

Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.

Ubuntu 22.04 LTS

dotnet6
No fix yet
dotnet7
No fix yet
dotnet8
Fixed in 8.0.121-8.0.21-0ubuntu1~22.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

dotnet10
Fixed in 10.0.100-10.0.0-0ubuntu1~24.04.1
dotnet8
Fixed in 8.0.121-8.0.21-0ubuntu1~24.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 25.10

dotnet10
Fixed in 10.0.100-10.0.0~rc2-0ubuntu1~25.10.2
dotnet8
Fixed in 8.0.121-8.0.21-0ubuntu1~25.10.1
dotnet9
Fixed in 9.0.111-9.0.10-0ubuntu1~25.10.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 26.04 LTS

dotnet10
Fixed in 10.0.100-10.0.0~rc2-0ubuntu1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.