Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2025-55315

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

VectorNETWORK

PublishedOct 14, 2025, 17:15

Published Bysecure@microsoft.com

Base Score

Score9.9

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

Microsoft.AspNetCore.Server.Kestrel.Core(NuGet)02.3.6N/A

Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.linux-x64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.osx-arm64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.osx-x64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.win-arm(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.win-arm64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.win-x64(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.win-x86(NuGet)10.0.0-rc.1.25451.10710.0.0-rc.2.25502.107N/A

Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.linux-x64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.osx-arm64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.osx-x64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.win-arm(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.win-arm64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.win-x64(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.win-x86(NuGet)9.0.09.0.10N/A

Microsoft.AspNetCore.App.Runtime.linux-arm(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.linux-arm64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-arm(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.linux-musl-x64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.linux-x64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.osx-arm64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.osx-x64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.win-arm(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.win-arm64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.win-x64(NuGet)8.0.08.0.21N/A

Microsoft.AspNetCore.App.Runtime.win-x86(NuGet)8.0.08.0.21N/A

References

Weakness Type

CWE-444

CVSS Metrics

Base Score

9.9

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK