‘Highest Ever’ Severity Score Assigned by Microsoft to ASP.NET Core Vulnerability

SecurityWeek reports that Microsoft’s October Patch Tuesday addressed a critical-severity vulnerability in the ASP.NET Core open source framework, tracked as CVE-2025-55315, which has a CVSS score of 9.9 and has been described by Barry Dorrans as the “highest ever”. The flaw is an HTTP request smuggling bug discovered in Kestrel, ASP.NET Core’s built-in web server, capable of enabling information leaks, file content tampering, or server crashes.

According to Microsoft, an attacker could smuggle an HTTP request inside another request to bypass front-end security controls or hijack other users’ credentials, with potential consequences including credential leakage and denial-of-service conditions. Attack scenarios discussed include logging in as another user, bypassing CSRF checks, and various injection risks, depending on how applications are implemented.

Microsoft addressed the vulnerability with updates for Visual Studio 2022 (versions 17.14, 17.12, and 17.10) and for ASP.NET Core (versions 2.3, 8.0, 9.0, and 10.0 RC1), plus the release of Microsoft.AspNetCore.Server.Kestrel[.]Core 2.3.6 containing fixes.