{"id":"CVE-2025-55315","published":"2025-10-14T17:00:10Z","modified":"2026-02-22T17:24:12Z","title":"ASP.NET Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"ASP.NET Core 2.3","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"ASP.NET Core 2.3","versions":[">= 2.3, < 2.3.6"]},{"vendor":"Microsoft","product":"ASP.NET Core 8.0","versions":[">= 8.0, < 8.0.21"]},{"vendor":"Microsoft","product":"ASP.NET Core 9.0","versions":[">= 9.0, < 9.0.10"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.10","versions":[">= 17.10.0, < 17.10.20"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.12","versions":[">= 17.12.0, < 17.12.13"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.14","versions":[">= 17.14.0, < 17.14.17"]}],"description":{"text":"Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling, in the ASP.NET Core 2.3 component of Microsoft's ASP.NET Core. An authorized attacker with network access can exploit it to bypass a security feature, with the attack requiring low privileges and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:41Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.66526,"percentile":0.99282,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"The Trans-Pacific Mesh & Starfield Pipeline Subversion","url":"https://otx.alienvault.com/pulse/69a185462e3c17c346bcdf79","created":"2026-02-27"},{"name":"Strategic Intel Brief: The \"Shadow Corridor\" Persistence","url":"https://otx.alienvault.com/pulse/69a1702ccff0b6afd6c01180","created":"2026-02-27"},{"name":"I See You, Too. #.icu","url":"https://otx.alienvault.com/pulse/69a1535debec4128ab952040","created":"2026-02-27"},{"name":"Credential Stuffing & C2 Config: AREK-BTC Variant (Zeppelin-Linked)","url":"https://otx.alienvault.com/pulse/69a145ba89a2b4af5a0aa721","created":"2026-02-27"}],"provenance":"machine"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315","tags":["vendor-advisory","patch"]},{"url":"https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040","tags":["exploit"]},{"url":"https://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","vulnerableRanges":["<2.3.6"],"patched":["2.3.6"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"},{"ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107",">=9.0.0, <9.0.10",">=8.0.0, <8.0.21"],"patched":["10.0.0-rc.2.25502.107","9.0.10","8.0.21"],"from":["GHSA-5rrx-jjjq-q2r5"],"provenance":"source"}],"advisories":[{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.Server.Kestrel.Core","vulnerableRanges":["<2.3.6"],"patched":["2.3.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107"],"patched":["10.0.0-rc.2.25502.107"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-x64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-arm64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-x64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=9.0.0, <9.0.10"],"patched":["9.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-arm64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.linux-x64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-arm64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.osx-x64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-arm64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x64","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"},{"id":"GHSA-5rrx-jjjq-q2r5","url":"https://github.com/advisories/GHSA-5rrx-jjjq-q2r5","severity":"CRITICAL","ecosystem":"NuGet","package":"Microsoft.AspNetCore.App.Runtime.win-x86","vulnerableRanges":[">=8.0.0, <8.0.21"],"patched":["8.0.21"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-34426","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34426","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52492,"url":"https://www.exploit-db.com/exploits/52492","title":"ASP.net  8.0.10 - Bypass","type":"webapps","platform":"multiple","date":"2026-04-06","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-04-06"},"pocGithub":{"count":6,"skipped":1,"earliest":"2025-10-16","earliestUrl":"https://github.com/nickcopi/CVE-2025-55315-detection-playground","repos":[{"name":"sirredbeard/CVE-2025-55315-repro","url":"https://github.com/sirredbeard/CVE-2025-55315-repro","stars":46,"created":"2025-10-16"},{"name":"ZemarKhos/CVE-2025-55315-PoC-Exploit","url":"https://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit","stars":10,"created":"2025-11-11"},{"name":"nickcopi/CVE-2025-55315-detection-playground","url":"https://github.com/nickcopi/CVE-2025-55315-detection-playground","stars":7,"created":"2025-10-16"},{"name":"7huukdlnkjkjba/CVE-2025-55315-","url":"https://github.com/7huukdlnkjkjba/CVE-2025-55315-","stars":6,"created":"2025-10-19"},{"name":"jlinebau/CVE-2025-55315-Scanner-Monitor","url":"https://github.com/jlinebau/CVE-2025-55315-Scanner-Monitor","stars":2,"created":"2025-10-24"}]},"first":{"date":"2025-10-16","source":"PoC-in-GitHub","url":"https://github.com/nickcopi/CVE-2025-55315-detection-playground"},"provenance":"source"},"exploitRefs":["https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040"],"flow":[],"timeline":[{"date":"2025-10-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-55315","provenance":"source"},{"date":"2025-10-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-04-06","url":"https://github.com/nickcopi/CVE-2025-55315-detection-playground","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":33.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9928"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-38178","published":"2023-08-08","fixed":"7.0.10","kev":false},{"cve":"CVE-2023-38180","published":"2023-08-08","fixed":"7.0.10","kev":true},{"cve":"CVE-2024-38168","published":"2024-08-13","fixed":"8.0.8","kev":false,"link":{"from":"CVE-2024-38168","to":"CVE-2025-55315","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64","fromFixed":"8.0.8","toFixed":"8.0.21","daysApart":427},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x86","fromFixed":"8.0.8","toFixed":"8.0.21","daysApart":427}]}},{"cve":"CVE-2025-55315","published":"2025-10-14","fixed":"10.0.0-rc.2.25502.107","kev":false},{"cve":"CVE-2026-42899","published":"2026-05-12","fixed":"10.0.8","kev":false,"link":{"from":"CVE-2025-55315","to":"CVE-2026-42899","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64","fromFixed":"8.0.21","toFixed":"8.0.27","daysApart":210},{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64","fromFixed":"9.0.10","toFixed":"9.0.16","daysApart":210}]}},{"cve":"CVE-2026-45591","published":"2026-06-09","fixed":"10.0.9","kev":false},{"cve":"CVE-2026-70186","published":"2026-10-13","fixed":"10.0.13","kev":false}],"package":"NuGet:Microsoft.AspNetCore.App.Runtime.win-x64"}}