CVE-2025-55315 Public exploit Critical · 9.9 EPSS 66.5%

ASP.NET Security Feature Bypass Vulnerability

Microsoft · ASP.NET Core 2.3

Summary

The flaw is an inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling, in the ASP.NET Core 2.3 component of Microsoft's ASP.NET Core. An authorized attacker with network access can exploit it to bypass a security feature, with the attack requiring low privileges and no user interaction.

Official description · CVE.org

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Breakdown

33.4 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure. No confirmed exploitation is recorded.

Disclosed14 Oct 2025day 0
Public exploit codePoC-in-GitHub16 Oct 2025+2 days

7 fixes in Microsoft.AspNetCore.App.Runtime.win-x64 over 3 years. The latest fix listed for Microsoft.AspNetCore.App.Runtime.win-x64 is 10.0.13.

Fixes in Microsoft.AspNetCore.App.Runtime.win-x64NuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

7.0.10CVE-2023-381788 Aug 2023
7.0.10CVE-2023-381808 Aug 2023KEV
8.0.8CVE-2024-3816813 Aug 2024
10.0.0-rc.2.25502.107CVE-2025-5531514 Oct 2025
10.0.8CVE-2026-4289912 May 2026
10.0.9CVE-2026-455919 Jun 2026
10.0.13CVE-2026-7018613 Oct 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

13 packages in 1 ecosystem. No single main package: each of these ships the affected code.

NuGetMicrosoft.AspNetCore.Server.Kestrel.Core
Affected: All versions before 2.3.6Upgrade to 2.3.6 or later
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-x64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.linux-x64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.osx-arm64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.osx-x64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.win-arm
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.10 (older lines: 10.0.0-rc.2.25502.107, 8.0.21)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.win-arm64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.win-x64
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5
NuGetMicrosoft.AspNetCore.App.Runtime.win-x86
Affected: 10.0.0-rc.1.25451.107 up to 10.0.0-rc.2.25502.107; 9.0.0 up to 9.0.10; 8.0.0 up to 8.0.21Upgrade to 9.0.21 (older lines: 10.0.0-rc.2.25502.107, 8.0.32)
GHSA-5rrx-jjjq-q2r5

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

The Trans-Pacific Mesh & Starfield Pipeline Subversion27 Feb 2026
Strategic Intel Brief: The "Shadow Corridor" Persistence27 Feb 2026
I See You, Too. #.icu27 Feb 2026
Credential Stuffing & C2 Config: AREK-BTC Variant (Zeppelin-Linked)27 Feb 2026

References

3 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2025-34426

ASP.net 8.0.10 - BypassEDB-52492 · webapps · multiple · 2026-04-06

, 30 Oct 2026

66.5%Top 0.72%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.28%).

3.1

9.9Critical · 9.9

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9928 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 6 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses4 pulses 1.6/3

CVSS base scorebase score 9.9 6.9/7

End-of-life productsupported or unknown 0.0

Total33.4

Record

Published: 14 Oct 2025
Modified: 22 Feb 2026
: CWE-444 Inconsistent Interpretation of HTTP Requests
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in Microsoft.AspNetCore.App.Runtime.win-x64NuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

What security researchers reported

Also mentioned in 4 community threat pulses (AlienVault OTX)

References

vendor-advisory 1

exploit 1

Other 1

techniques