CVE-2025-55315

ASP.NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Affected

Microsoft · ASP.NET Core 2.3 · ASP.NET Core 8.0 · ASP.NET Core 9.0 · Microsoft Visual Studio 2022 version 17.10 · Microsoft Visual Studio 2022 version 17.12 · Microsoft Visual Studio 2022 version 17.14

CVSS v3.1 MICROSOFT

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

EPSS

66.53% chance of exploitation in the next 30 days, 99th percentile

Published

2025-10-14

Updated

2026-02-22

Proof-of-concept exploits (4)

• 7huukdlnkjkjba/CVE-2025-55315-6★ · 2025-10-19
• MartinFabianIonut/CVE-2025-553151★ · 2025-11-30
• ZemarKhos/CVE-2025-55315-PoC-Exploit10★ · 2025-11-11
• sirredbeard/CVE-2025-55315-repro46★ · 2026-01-12

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52492

Security advisories

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315
• advisories/GHSA-5rrx-jjjq-q2r5

References

• CVE Record
• NVD entry

Related

• CVE-2025-55182
• CVE-2026-44403
• CVE-2025-60876