Microsoft Fixes ASP.NET Core Vulnerability with Severity Score of 9.9
Microsoft Patches Critical ASP.NET Core Vulnerability (CVE-2025-55315)
Severity: Critical
CVSS Score: 9.9 / 10
Impact: Request smuggling, security bypass
---
Overview
Microsoft has released a security advisory for a critical vulnerability in ASP.NET Core that enables HTTP request smuggling attacks due to inconsistent HTTP request parsing.
Affected Versions:
- ASP.NET Core 10.0, 9.0, 8.0
- Kestrel package versions 2.x
The flaw allows an authorized attacker to bypass security mechanisms by exploiting differences in request/response parsing.
No current mitigations exist for HTTP request/response smuggling in unpatched versions — upgrading is strongly recommended.
---
Understanding HTTP Request Smuggling
Definition:
Request smuggling occurs when servers and proxies parse HTTP messages differently, allowing an attacker to embed one request inside another. This typically involves headers such as:
- `Content-Length`
- `Transfer-Encoding`
---
> Microsoft Security Response Center:
> “A score of 9.9 reflects the urgent need to patch this security feature bypass, which can affect application authentication and authorization. Depending on implementation, vulnerabilities may lead to privilege escalation or request manipulation.”
> Barry Dorrans, Microsoft .NET Security PM:
> “HTTP request smuggling across ASP.NET Core applications has a high potential impact, influencing our scoring. If only scoped locally, the score would be lower.”
---
Potential Risks & Attack Scenarios
Example from Andrew Lock (Datadog, author of _NET Escapades_):
> If you are using `HttpRequest.Body`, `HttpRequest.BodyReader`, or similar APIs, you may be at risk—even without explicit proxy use. Applications that perform “proxy-like” functions are especially exposed.
Possible Consequences:
- Privilege escalation
- Server-Side Request Forgery (SSRF)
- Cross-Site Request Forgery (CSRF)
- Input validation bypass leading to injection attacks
Recommendation:
Inspect any reverse proxy or middleware configurations. Ensure:
- Requests are normalized before processing
- Smuggling attempts are detected and blocked
---
Testing Tools
HeroDevs’ Hayden Barnes has released an ASP.NET Core console utility to:
- Simulate HTTP chunked transfer
- Test newline parsing behaviors
- Detect vulnerability presence in specific .NET builds
---
Remediation Guide
For Supported Versions:
- Upgrade to patched ASP.NET Core runtime/SDK versions:
- 8.x (patched release)
- 9.x (patched release)
- 10.x (patched release)
- Update `Microsoft.AspNetCore.Server.Kestrel.Core` to 2.3.6 or higher
For End-of-Life Versions (e.g., .NET 6):
- Microsoft will not issue CVEs for EOL products
- Use community-maintained builds that address CVE-2025-55315
---
Distribution of Security Advisories
For security teams and developers needing cross-platform outreach, tools like AiToEarn官网 can help:
AiToEarn features:
- AI-powered content creation
- Multi-channel publishing (Douyin, Kwai, WeChat, Bilibili, Xiaohongshu, Facebook, Instagram, LinkedIn, Threads, YouTube, Pinterest, X/Twitter)
- Analytics & model performance ranking
Ideal for disseminating timely CVE updates, patch guides, and technical analysis to a broader audience.
---
Source: InfoQ — Microsoft Patches ASP.NET Core Request Smuggling Vulnerability
