Microsoft has released a critical security advisory addressing a high-severity vulnerability in ASP.NET Core, identified as CVE-2025-55315, with a CVSS score of high. This vulnerability affects ASP.NET Core versions 10.0, 9.0, 8.0, and the Kestrel package for 2.x. It allows an authorized attacker to bypass security features due to inconsistent parsing of HTTP requests and responses, commonly referred to as HTTP request smuggling. Microsoft has noted there are no mitigating factors for this scenario and strongly urges developers to patch to the fixed versions immediately.

The vulnerability arises from differences in how servers and proxies parse HTTP requests, particularly using headers like Content-Length or Transfer-Encoding to hide one request inside another. Exploiting this flaw could allow attackers to manipulate request processing, potentially leading to privilege escalation, request manipulation, server-side request forgery (SSRF), cross-site request forgery (CSRF) bypass, and injection attacks. Microsoft emphasizes that the severity score reflects the potential impact on applications built on ASP.NET, rather than the framework itself.

Experts explain that even applications not explicitly acting as proxies may be vulnerable if they handle request bodies or perform “proxy-like” processing. Hayden Barnes also released a console application for developers to test HTTP chunked transfer and newline parsing behavior, helping confirm whether specific .NET builds are affected. Misunderstandings initially arose among developers regarding .NET 6 and earlier releases since Microsoft does not issue CVEs for end-of-life software.

To mitigate the vulnerability, developers must update to the patched ASP.NET Core runtime/SDK versions for 8, 9, or 10, or update the Microsoft.AspNetCore.Server.Kestrel.Core package to version 2.3.6 or later. Third-party vendors have also released fixes for unsupported .NET 6 versions. Microsoft advises reviewing proxy configurations to ensure they normalize requests and detect smuggling attempts, thereby preventing attackers from bypassing critical security mechanisms in web applications.

Impact