Microsoft Patches Critical ASP.NET Core Vulnerability with 9.9 Severity Score

Microsoft recently released a security advisory and patched a critical vulnerability in ASP.NET Core that allows an attacker to bypass a security feature over a network due to an inconsistent interpretation of HTTP requests. With a CVSS score of 9.9 out of 10, CVE-2025-55315 is the highest-rated Microsoft vulnerability.

The vulnerability has been identified in ASP.NET Core versions 10.0, 9.0, 8.0, and the Kestrel package for 2.x. An attacker who is already authorized can bypass a security feature by exploiting inconsistent parsing of HTTP requests and responses. Microsoft states there are no known mitigating factors for the HTTP request/response smuggling scenario and strongly recommends patching to the listed fixed versions to prevent the security bypass.

HTTP request smuggling exploits differences in how servers and proxies parse HTTP requests, using headers such as Content-Length or Transfer-Encoding to hide one request within another. In a follow-up article, the…