CVE-2025-55315

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Affected products

Alt Linux, Asp.Net Core, Almalinux, Centos, Linuxmint, Red Hat, Red Os, Rocky Linux

Microsoft Asp.net Core

< 2.3.6, 8.0.21, 9.0.10

Microsoft Visual Studio 2022

< 17.10.20, 17.12.13, 17.14.17

Fix

Available

CVSS 3.1

9.9 CRITICAL

EPSS

65.8% (99th percentile)

Weakness

CWE-444

NVD status

Modified

Published

2025-10-14