Microsoft has recently addressed CVE-2025-55315, a critical vulnerability in the <a href="http://ASP.NET" target="_blank" rel="noopener nofollow">ASP.NET</a> Core’s Kestrel web server, with a Common Vulnerability Scoring System (CVSS) score of 9.9—the highest ever for this framework. This flaw exposes applications to HTTP request smuggling attacks that could bypass essential authentication and security measures.
The vulnerability affects all supported versions of <a href="http://ASP.NET" target="_blank" rel="noopener nofollow">ASP.NET</a> Core, including versions 8, 9, 10, and the legacy 2.3. The threats posed by this vulnerability include allowing attackers to conceal unauthorized requests within legitimate ones, potentially compromising authentication and Cross-Site Request Forgery (CSRF) protections.
While the severity score indicates a worst-case impact, the actual risk varies based on the specific application code and deployment setup. Notably, applications managed through properly configured reverse proxies might already have a degree of protection against this exploit.
Microsoft has released patched versions across all impacted <a href="http://ASP.NET" target="_blank" rel="noopener nofollow">ASP.NET</a> Core releases and strongly advises organizations to update their systems immediately, despite the absence of known active exploits at this time. Developers are encouraged to update their .NET SDK or the Kestrel.Core package to version 2.3.6 or later to mitigate any potential risks.

Collections

Microsoft patched CVE-2025-55315, a critical vulnerability with CVSS score 9.9 in ASP.NET Core's Kestrel web server. The flaw enables HTTP request smuggling attacks that can bypass authentication and CSRF protections across all supported versions (2.3, 8, 9, 10). While no active exploits exist yet, organizations should immediately update to .NET SDK or Kestrel.Core 2.3.6 or later. Applications behind properly configured reverse proxies may have partial protection, but actual risk depends on specific deployment configurations.

Microsoft Patches Critical ASP.NET Core Vulnerability in Kestrel Server