CVE-2025-55315

The vulnerability results from inconsistent interpretation of HTTP requests (CWE-444) by ASP.NET Core components. An attacker sends crafted HTTP requests that are parsed differently by the front-end and back-end servers, causing a discrepancy in the delineation of request boundaries. This makes it possible to smuggle additional HTTP requests that bypass security controls applied by intermediate infrastructure layers (e.g., reverse proxy, web application firewalls). The attack vector is network-based, requires no user interaction, and only requires basic privileges (PR:L) to execute.

An authenticated attacker can bypass application security features, which in the context of HTTP request smuggling can lead to unauthorized data access, session hijacking of other users, or further privilege escalation. High impact on confidentiality and integrity (C:H, I:H) indicates the possibility of sensitive data disclosure and modification of application resources.

Apply patches available from the vendor according to the references — the update should be deployed immediately due to the critical threat level. Detailed information about versions containing the fix is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315. Until the patch is deployed, consider restrictive configuration of proxy layers and web application firewalls to limit the possibility of request smuggling.

Microsoft Visual Studio 2022 and Microsoft ASP.NET Core — specific versions indicated in vendor references (MSRC).