CVE-2025-55315

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Database specific

{
    "unresolved_ranges": [
        {
            "vendor_product": "microsoft:asp.net_core",
            "cpes": [
                "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "2.3.0"
                },
                {
                    "fixed": "2.3.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "vendor_product": "microsoft:visual_studio_2022",
            "cpes": [
                "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "17.10.0"
                },
                {
                    "fixed": "17.10.20"
                },
                {
                    "introduced": "17.12.10"
                },
                {
                    "fixed": "17.12.13"
                },
                {
                    "introduced": "17.14.0"
                },
                {
                    "fixed": "17.14.17"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

References

Affected packages

Git / github.com/dotnet/aspnetcore

Affected ranges

Type

GIT

Repo

https://github.com/dotnet/aspnetcore

Events

Introduced

3f1acb59718cadf111a0a796681e3d3509bb3381

Fixed

6254f5ca64f85b90327592dff67ea6b2ec0262c6

Introduced

af22effae4069a5dfb9b0735859de48820104f5b

Fixed

5bae930797f60d2d04f3b1df6a33eaca85fc5f28

Database specific

{
    "cpe": "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.21"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.10"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v8.*

v8.0.0

v8.0.1

v8.0.10

v8.0.11

v8.0.12

v8.0.13

v8.0.14

v8.0.15

v8.0.16

v8.0.17

v8.0.18

v8.0.19

v8.0.2

v8.0.20

v8.0.3

v8.0.4

v8.0.5

v8.0.7

v8.0.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55315.json"