CVE-2025-55315
CriticalCVSS 9.9Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Inconsistent interpretation of HTTP requests ('HTTP request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
Risk Assessment
An attacker could bypass security controls and perform request smuggling attacks, potentially leading to unauthorized access or data manipulation.
Recommendation
Update ASP.NET Core to the latest patched version.
Other vulnerabilities in ASP.NET Core
See all- CVE-2017-11879High
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL.
- CVE-2017-0249High
An elevation of privilege vulnerability exists when ASP.NET Core fails to properly sanitize web requests.
- CVE-2026-88092Critical
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-70188Critical
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-40372Critical
A vulnerability in ASP.NET Core due to improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.
- CVE-2021-31957Medium
ASP.NET Core has a Denial of Service (DoS) vulnerability that could lead to service overload and unavailability.
- CVE-2020-1161High
Denial of service vulnerability in ASP.NET Core when improperly handling web requests. A remote unauthenticated attacker could send specially crafted requests, causing the application to become unavailable.
- CVE-2026-109468High
A vulnerability in ASP.NET Core involves allocation of resources without limits or throttling. An unauthenticated attacker can cause a denial of service over a network.
- CVE-2026-96236High
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- CVE-2026-96233High
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS