Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
.NET
.NET NuGet
Not in CISA KEV
CRITICAL severity

CVE-2025-55315 — Microsoft.AspNetCore.Serv…

CRITICAL

CVE-2025-55315 is a critical-severity (CVSS 9.9) CWE-444 vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. 5 public exploit references exist, so weaponization risk is real. A fix is available for Microsoft.AspNetCore.Server.Kestrel.Core — see the affected versions and patch details below.

Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability

Also known asBIT-aspnet-core-2025-55315GHSA-5rrx-jjjq-q2r5
Published
Oct 14, 2025
Updated
Jul 8, 2026
Affected
37 pkgs
Patched
37 / 37
Exploits
5 known
Exploitation data as of Sep 18, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-55315.

EPSS Exploitation Probability

via FIRST.org ↗
65.9%probability of exploitation in next 30 days
High Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

How urgent is this, really

CVE-2025-55315 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE sits: patch-first territory.

Where this sits among everything scored

Of 377,238 CVEs with a current EPSS score, this one falls in the 50–90% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.

Real-World Exposure

37 pkgs affected
.NETMicrosoft.AspNetCore.Server.Kestrel.Core.NETMicrosoft.AspNetCore.App.Runtime.linux-arm.NETMicrosoft.AspNetCore.App.Runtime.linux-arm64.NETMicrosoft.AspNetCore.App.Runtime.linux-musl-arm.NETMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64.NETMicrosoft.AspNetCore.App.Runtime.linux-musl-x64.NETMicrosoft.AspNetCore.App.Runtime.linux-x64.NETMicrosoft.AspNetCore.App.Runtime.osx-arm64+29 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Affected Packages

37 total 37 fixed
EcosystemPackageVulnerable rangeFix
.NETNuGetMicrosoft.AspNetCore.Server.Kestrel.Coreall versions2.3.6dotnet add package Microsoft.AspNetCore.Server.Kestrel.Core --version 2.3.6
.NETNuGetMicrosoft.AspNetCore.App.Runtime.linux-arm≥ 10.0.0-rc.1.25451.107&&< 10.0.0-rc.2.25502.10710.0.0-rc.2.25502.107dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 10.0.0-rc.2.25502.107
.NETNuGetMicrosoft.AspNetCore.App.Runtime.linux-arm64≥ 10.0.0-rc.1.25451.107&&< 10.0.0-rc.2.25502.10710.0.0-rc.2.25502.107dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 10.0.0-rc.2.25502.107
.NETNuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm≥ 10.0.0-rc.1.25451.107&&< 10.0.0-rc.2.25502.10710.0.0-rc.2.25502.107dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 10.0.0-rc.2.25502.107
.NETNuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64≥ 10.0.0-rc.1.25451.107&&< 10.0.0-rc.2.25502.10710.0.0-rc.2.25502.107dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 10.0.0-rc.2.25502.107
.NETNuGetMicrosoft.AspNetCore.App.Runtime.linux-musl-x64≥ 10.0.0-rc.1.25451.107&&< 10.0.0-rc.2.25502.10710.0.0-rc.2.25502.107dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 10.0.0-rc.2.25502.107
Exploits & PoCs
5

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-52492webappsmultiple

ASP.net 8.0.10 - Bypass

by Mohammed Idrees Banyamer · Apr 6, 2026

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.AspNetCore.Server.Kestrel.Core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-55315 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2025-55315 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2025-55315. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

The Red Hat Product Security team has assessed this issue as Important. An authorized network attacker can exploit inconsistent HTTP request parsing in ASP.NET Core to bypass security controls (HTTP request smuggling), potentially exposing or enabling unauthorized actions on request data in affected .NET…

ProductFixed inAdvisory
Red Hat Enterprise Linux 10dotnet8.0-0:8.0.121-1.el10_0RHSA-2025:18152
Red Hat Enterprise Linux 10dotnet9.0-0:9.0.111-1.el10_0RHSA-2025:18153
Red Hat Enterprise Linux 10dotnet10.0-0:10.0.100~rc.2.25502.107-0.12.el10_1RHBA-2025:20993
Red Hat Enterprise Linux 8dotnet8.0-0:8.0.121-1.el8_10RHSA-2025:18148
Red Hat Enterprise Linux 8dotnet9.0-0:9.0.111-1.el8_10RHSA-2025:18150
Red Hat Enterprise Linux 9dotnet10.0-0:10.0.100~rc.2.25502.107-0.10.el9_7RHBA-2025:20916
Red Hat Enterprise Linux 9dotnet8.0-0:8.0.121-1.el9_6RHSA-2025:18149
Red Hat Enterprise Linux 9dotnet9.0-0:9.0.111-1.el9_6RHSA-2025:18151
UbuntuCRITICAL
USN-7822-1Ubuntu

Frequently Asked Questions

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
O3 Security · Impact-Aware SCA

Is CVE-2025-55315 in your dependencies?

O3 Security finds CVE-2025-55315 across NuGet dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
CVE-2025-55315: Microsoft.AspNetCore.Serv… | O3 Security