CVE-2025-55315: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an aut

This week

CRITICAL 9.9WATCHLISTUPGRADEUPGRADE

CVE-2025-55315 is a critical-severity flaw (CVSS 9.9) affecting asp.net core, visual studio 2022. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	9.9 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	66.5% (top 1%)
CISA exploited list	No
Weakness	CWE-444
Published	2025-10-14
Last modified	2026-10-18

Publisher (CNA): Microsoft Corporation · Vendor: microsoft

Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-10-14 17:15 UTCPublished CVE record published
2026-10-18 21:10 UTCUpdated Record last modified

microsoft asp.net core UPGRADE

Affected: >= 2.3.0 and < 2.3.6 · >= 8.0.0 and < 8.0.21 · >= 9.0.0 and < 9.0.10

Fixed in: 2.3.6, 8.0.21, 9.0.10

Safe to downgrade to: a release before 2.3.0

1. Check installed version

apt-cache policy asp.net-core || rpm -q asp.net-core || asp.net-core --version

2. UPGRADE to 2.3.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade asp.net-core

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade asp.net-core

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.3.0 (Debian / Ubuntu)

apt-cache madison asp.net-core sudo apt install asp.net-core=<VERSION_BEFORE_2.3.0> sudo apt-mark hold asp.net-core

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list asp.net-core sudo dnf downgrade asp.net-core-<VERSION_BEFORE_2.3.0> sudo dnf versionlock add asp.net-core

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

microsoft visual studio 2022 UPGRADE

Affected: >= 17.10.0 and < 17.10.20 · >= 17.12.10 and < 17.12.13 · >= 17.14.0 and < 17.14.17

Fixed in: 17.10.20, 17.12.13, 17.14.17

Safe to downgrade to: a release before 17.10.0

1. Check installed version

apt-cache policy visual-studio-2022 || rpm -q visual-studio-2022 || visual-studio-2022 --version

2. UPGRADE to 17.10.20 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade visual-studio-2022

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade visual-studio-2022

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 17.10.0 (Debian / Ubuntu)

apt-cache madison visual-studio-2022 sudo apt install visual-studio-2022=<VERSION_BEFORE_17.10.0> sudo apt-mark hold visual-studio-2022

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list visual-studio-2022 sudo dnf downgrade visual-studio-2022-<VERSION_BEFORE_17.10.0> sudo dnf versionlock add visual-studio-2022

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-arm · FIXED · 10.0.0-rc.2.25502.107 · vulnerable: = 10.0.0-rc.1.25451.107 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 10.0.0-rc.2.25502.107

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-arm64 · FIXED · 10.0.0-rc.2.25502.107 · vulnerable: = 10.0.0-rc.1.25451.107 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 10.0.0-rc.2.25502.107

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-musl-arm · FIXED · 10.0.0-rc.2.25502.107 · vulnerable: = 10.0.0-rc.1.25451.107 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 10.0.0-rc.2.25502.107

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 · FIXED · 10.0.0-rc.2.25502.107 · vulnerable: = 10.0.0-rc.1.25451.107 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 10.0.0-rc.2.25502.107

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-musl-x64 · FIXED · 10.0.0-rc.2.25502.107 · vulnerable: = 10.0.0-rc.1.25451.107 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 10.0.0-rc.2.25502.107

NuGet (.NET) · Microsoft.AspNetCore.App.Runtime.linux-x64 · FIXED · 10.0.0-rc.2.25502.107 · vulnerable: = 10.0.0-rc.1.25451.107 · source

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 10.0.0-rc.2.25502.107

Fedora 46 · byobu · FIXED · 7.23-1.fc46 · FEDORA-2026-08f2b53446 · source

sudo dnf upgrade --advisory=FEDORA-2026-08f2b53446

Ubuntu 22.04 · dotnet6 · DEFERRED

Ubuntu 22.04 · dotnet8 · FIXED · 8.0.121-8.0.21-0ubuntu1~22.04.1

sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.121-8.0.21-0ubuntu1~22.04.1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · dotnet8 · FIXED · 8.0.121-8.0.21-0ubuntu1~24.04.1

sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.121-8.0.21-0ubuntu1~24.04.1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 25.04 · dotnet8 · FIXED · 8.0.121-8.0.21-0ubuntu1~25.04.1

sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.121-8.0.21-0ubuntu1~25.04.1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 25.10 · dotnet8 · FIXED · 8.0.121-8.0.21-0ubuntu1~25.10.1

sudo apt update && sudo apt install --only-upgrade dotnet8 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' dotnet8)" ge "8.0.121-8.0.21-0ubuntu1~25.10.1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · dotnet8.0 · FIXED · dotnet8.0-8.0.121-1.el10_0

sudo dnf upgrade --advisory=RHSA-2025:18152 rpm -q dotnet8.0

RHEL 10 · dotnet9.0 · FIXED · dotnet9.0-9.0.111-1.el10_0

sudo dnf upgrade --advisory=RHSA-2025:18153 rpm -q dotnet9.0

RHEL 10 · dotnet10.0 · FIXED · dotnet10.0-10.0.100~rc.2.25502.107-0.12.el10_1

sudo dnf upgrade --advisory=RHBA-2025:20993 rpm -q dotnet10.0

RHEL 8 · dotnet8.0 · FIXED · dotnet8.0-8.0.121-1.el8_10

sudo dnf upgrade --advisory=RHSA-2025:18148 rpm -q dotnet8.0

RHEL 8 · dotnet9.0 · FIXED · dotnet9.0-9.0.111-1.el8_10

sudo dnf upgrade --advisory=RHSA-2025:18150 rpm -q dotnet9.0

Alpine 3.20 · dotnet8-runtime · FIXED · dotnet8-runtime-8.0.21-r0

apk add --upgrade dotnet8-runtime apk info -v dotnet8-runtime

Alpine 3.21 · dotnet8-runtime · FIXED · dotnet8-runtime-8.0.21-r0

apk add --upgrade dotnet8-runtime apk info -v dotnet8-runtime

Alpine 3.21 · dotnet9-runtime · FIXED · dotnet9-runtime-9.0.10-r0

apk add --upgrade dotnet9-runtime apk info -v dotnet9-runtime

Alpine 3.22 · dotnet8-runtime · FIXED · dotnet8-runtime-8.0.21-r0

apk add --upgrade dotnet8-runtime apk info -v dotnet8-runtime

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2025-1231 · source

sudo dnf update --advisory=ALAS2023-2025-1231

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: sirredbeard/CVE-2025-55315-repro (46 stars)
GitHub PoC: ZemarKhos/CVE-2025-55315-PoC-Exploit (10 stars)
GitHub PoC: nickcopi/CVE-2025-55315-detection-playground (7 stars)
Write-up: gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040
Exploit-DB: ASP.net 8.0.10 - Bypass

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-55315?

asp.net core: upgrade to 2.3.6, 8.0.21, 9.0.10; visual studio 2022: upgrade to 17.10.20, 17.12.13, 17.14.17. Exact commands for each OS are on this page.

Is CVE-2025-55315 being exploited?

CVE-2025-55315 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-55315 affect?

CVE-2025-55315 affects asp.net core, visual studio 2022. Severity is critical (CVSS 9.9). Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

How urgent is CVE-2025-55315?

Priority 69/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist

Software pages

.NET vulnerabilities · Visual Studio vulnerabilities

Related CVEs

CVE-2026-40372 CRITICAL 9.1 UPGRADE Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate pr
CVE-2026-88092 CRITICAL 9.4 UPGRADE UPGRADE Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an una
CVE-2026-69304 MEDIUM 5.9 UPGRADE UPGRADE Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attack
CVE-2026-26130 HIGH 7.5 UPGRADE Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny s
CVE-2025-26682 HIGH 7.5 UPGRADE UPGRADE Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny s

References

← Back to latest CVEs