ASP.NET Core CVE-2025-55315

Exploitation requires the ASP.NET Core application to be served by the affected Kestrel HTTP server (the default in-process/edge server for ASP.NET Core) and reachable over the network, with the supplied CVSS vector indicating low-privilege access (PR:L) and no user interaction. Realistic exploitability is heightened when Kestrel runs behind an HTTP proxy/load balancer or CDN whose request-framing interpretation differs from Kestrel's, which is what enables the smuggling desync; in pure direct-to-Kestrel deployments the practical impact of smuggling is narrower. Limiting factors: the attacker needs at least low-privilege access per the vector, and the affected runtime/framework versions must be in use (fixed in dotnet8-runtime 8.0.21-r0 and corresponding ASP.NET Core releases), so patched or non-Kestrel hosting reduces exposure.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, 9.9) describes a network-reachable, low-complexity HTTP request smuggling flaw (CWE-444) in Microsoft ASP.NET Core / Kestrel with a scope change, meaning a compromise reaches beyond the vulnerable component to back-end systems and other users' sessions. Signals are largely consistent: a public exploit exists (exploit-db 52492) and the issue has drawn significant security-community attention (Andrew Lock's writeup characterizes it as among the worst .NET vulnerabilities). EPSS is only 1.68% (82nd percentile) - moderate and somewhat at odds with a 9.9 CVSS and public POC; this gap typically reflects that request-smuggling exploitation is context-dependent (it depends on the specific proxy/back-end topology in front of Kestrel) rather than a single universally reliable mass-exploit, so widespread automated exploitation is not yet evidenced. There is no CISA KEV listing in the provided data, so active in-the-wild exploitation is NOT confirmed - treat this as 'exploit code exists' rather than 'actively exploited.' The CVSS PR:L (authenticated/low-privilege) qualifier is worth verifying against vendor guidance, as classic request smuggling is often reachable by unauthenticated attackers; the provided vector is authoritative here, so authentication is treated as low-privilege required.

An attacker who can reach an ASP.NET Core / Kestrel endpoint sends crafted HTTP requests with ambiguous or malformed framing (e.g., conflicting Content-Length/Transfer-Encoding handling) that Kestrel and a fronting proxy interpret differently. The smuggled request is then processed in another user's or a privileged context, allowing the attacker to poison the request stream, bypass front-end security controls, and access or inject into other sessions. Publicly available exploit code (exploit-db 52492) lowers the bar to reproduce the technique.