CVE-2025-55315: Critical 9.9/10 Flaw in ASP.NET Core Enables Unauthenticated Attack

CVE-2025-55315 is described as a critical 9.9/10 flaw in ASP.NET Core that enables unauthenticated attackers to smuggle secondary HTTP requests within the original one, primarily affecting the Kestrel web server. The article notes that exploitation could bypass multiple security controls and potentially expose sensitive user credentials, compromise file integrity on the target server, or trigger system crashes.

To mitigate the issue, Microsoft has released security updates across multiple product versions and urges developers to recompile and redeploy their applications; those running .NET 8 or later should install the latest .NET update via Windows Update, while users of .NET 2.3 must update the Microsoft.AspNet.Server.Kestrel[.]Core package to version 2.3.6 followed by recompilation and redeployment.

For standalone or single-file applications, the update and rebuilding steps are also required, and patches exist for related products such as Visual Studio 2022 and ASP.NET Core versions 2.3, 8.0 and 9.0. According to Microsoft’s .NET Security Program Manager, the score reflects the worst-case scenario, but the real-world impact hinges on how the affected framework is implemented.

According to the article, Microsoft emphasises applying updates promptly to prevent potential exploitation that could compromise data confidentiality and system integrity.