CVE-2025-55315HighCVSS 9.9
ASP.NET Security Feature Bypass Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
🎯 Affected products6
- ASP.NET Core 2.3
- ASP.NET Core 8.0
- ASP.NET Core 9.0
- Microsoft Visual Studio 2022 version 17.10
- Microsoft Visual Studio 2022 version 17.12
- Microsoft Visual Studio 2022 version 17.14
✅ Remediation
KB5068331 (Security Update) — fixed build 8.0.21 KB5068332 (Security Update) — fixed build 9.0.10 KBRelease Notes (Security Update) — fixed build 2.3.6 KBRelease Notes (Security Update) — fixed build 17.12.13 KBRelease Notes (Security Update) — fixed build 17.10.20 KBRelease Notes (Security Update) — fixed build 17.14.17
🔗 References (10)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315
- patchhttps://dotnet.microsoft.com/en-us/download/dotnet/8.0
- referencehttps://support.microsoft.com/help/5068331
- patchhttps://dotnet.microsoft.com/en-us/download/dotnet/9.0
- referencehttps://support.microsoft.com/help/5068332
- patchhttps://github.com/dotnet/aspnetcore/issues/64033
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.12
- referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.10
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.14