Microsoft Issues Alert on ASP.NET Flaw Allowing HTTP Request Smuggling Attacks

Microsoft has released a critical security update addressing a vulnerability in ASP.NET Core's Kestrel web server that could allow HTTP request smuggling attacks. On 14 October 2025, patches were issued for CVE-2025-55315, described as a security feature bypass with a CVSS score of 9.9, placing it in the critical category. The flaw stems from improper request parsing within Kestrel, which can enable attackers to inject hidden requests into legitimate traffic and bypass authentication and authorisation checks.

HTTP request smuggling can exploit differences in how proxies and backend servers interpret headers such as Content-Length and Transfer-Encoding, potentially leading to elevation of privilege, server-side request forgery, or even code execution in worst-case scenarios. The advisory emphasises that organisations running ASP.NET Core applications should prioritise applying the October 14, 2025 update, with production deployments using Kestrel particularly prompted to patch promptly.

According to the article, the vulnerability requires no user interaction and can be exploited remotely over the network with low attack complexity, underscoring the need for immediate remediation.