ASP.NET Security Feature Bypass Vulnerability
Priority HIGH 79CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Partial Red Hat: 10 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub, Red Hat and Microsoft. Impact type from Microsoft.
Summary
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.67162 99th percentileScored 2026-11-07
Fix Partial Microsoft.AspNetCore.Server.Kestrel.Core (NuGet): 2.3.6Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): 10.0.0-rc.2.25502.107, 9.0.10, 8.0.21+11 more productsRed Hat: 10 advisoriesMicrosoft: 2 updatesRed Hat: 10 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | ASP.NET Core 2.3 | 2.3 to before 2.3.6 | 2.3.6 | Patch available | CNA |
| Microsoft | ASP.NET Core 8.0 | 8.0 to before 8.0.21 | 8.0.21 | Patch available | CNA |
| Microsoft | ASP.NET Core 9.0 | 9.0 to before 9.0.10 | 9.0.10 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.10 | 17.10.0 to before 17.10.20 | 17.10.20 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.12 | 17.12.0 to before 17.12.13 | 17.12.13 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.14 | 17.14.0 to before 17.14.17 | 17.14.17 | Patch available | CNA |
| — | Microsoft.AspNetCore.Server.Kestrel.Core (NuGet) | before 2.3.6 | 2.3.6 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) | 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 | 10.0.0-rc.2.25502.107 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) | 9.0.0 to before 9.0.10 | 9.0.10 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
| — | Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) | 8.0.0 to before 8.0.21 | 8.0.21 | Patch available | GHSA-5rrx-jjjq-q2r5 |
- ASP.NET Core 2.3 VendorMicrosoft Affected 2.3 to before 2.3.6 Fixed in 2.3.6 Patch available CNA
- ASP.NET Core 8.0 VendorMicrosoft Affected 8.0 to before 8.0.21 Fixed in 8.0.21 Patch available CNA
- ASP.NET Core 9.0 VendorMicrosoft Affected 9.0 to before 9.0.10 Fixed in 9.0.10 Patch available CNA
- Microsoft Visual Studio 2022 version 17.10 VendorMicrosoft Affected 17.10.0 to before 17.10.20 Fixed in 17.10.20 Patch available CNA
- Microsoft Visual Studio 2022 version 17.12 VendorMicrosoft Affected 17.12.0 to before 17.12.13 Fixed in 17.12.13 Patch available CNA
- Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.17 Fixed in 17.14.17 Patch available CNA
- Microsoft.AspNetCore.Server.Kestrel.Core (NuGet) Vendor— Affected before 2.3.6 Fixed in 2.3.6 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 10.0.0-rc.1.25451.107 to before 10.0.0-rc.2.25502.107 Fixed in 10.0.0-rc.2.25502.107 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
- Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-5rrx-jjjq-q2r5
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* | 2.3.0 to before 2.3.6; 8.0.0 to before 8.0.21; 9.0.0 to before 9.0.10 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* | 17.10.0 to before 17.10.20; 17.12.10 to before 17.12.13; 17.14.0 to before 17.14.17 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:* Versions 2.3.0 to before 2.3.6; 8.0.0 to before 8.0.21; 9.0.0 to before 9.0.10 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* Versions 17.10.0 to before 17.10.20; 17.12.10 to before 17.12.13; 17.14.0 to before 17.14.17 Vulnerable ·Microsoft
Remediation
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.Server.Kestrel.Core (NuGet) Fixed in 2.3.6 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Fixed in 10.0.0-rc.2.25502.107 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Fixed in 9.0.10 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet) Fixed in 8.0.21 Advisory →
- Fix · GHSA-5rrx-jjjq-q2r5 Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) Fixed in 8.0.21 Advisory →
Red Hat 10 advisories
- RHSA-2026:9205 Released 2026-04-21 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet9.0-9.0.116-1.hum1@src
- RHSA-2026:9080 Released 2026-04-20 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet8.0-8.0.126-1.hum1@src
- RHSA-2025:23225 Released 2025-12-15 · Red Hat rating CriticalRed Hat OpenShift Dev Spaces 3.25.0 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/openvsx-rhel9, registry.redhat.io/devspaces/pluginregistry-rhel9 +3
Show 7 more Red Hat advisories
- RHSA-2025:18256 Released 2025-10-16 · Red Hat rating Important.NET 8.0 security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) aspnetcore-runtime-8.0-8.0.21-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.21-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.21-1.el9_4 +11
- RHSA-2025:18151 Released 2025-10-15 · Red Hat rating Important.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-9.0-9.0.10-1.el9_6, aspnetcore-runtime-dbg-9.0-9.0.10-1.el9_6, aspnetcore-targeting-pack-9.0-9.0.10-1.el9_6 +12
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el9_6
- RHSA-2025:18150 Released 2025-10-15 · Red Hat rating Important.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-9.0-9.0.10-1.el8_10, aspnetcore-runtime-dbg-9.0-9.0.10-1.el8_10, aspnetcore-targeting-pack-9.0-9.0.10-1.el8_10 +13
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el8_10
- RHSA-2025:18153 Released 2025-10-15 · Red Hat rating Important.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-9.0-9.0.10-1.el10_0, aspnetcore-runtime-dbg-9.0-9.0.10-1.el10_0, aspnetcore-targeting-pack-9.0-9.0.10-1.el10_0 +12
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el10_0
- RHSA-2025:18152 Released 2025-10-15 · Red Hat rating Important.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.21-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.21-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.21-1.el10_0 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el10_0
- RHSA-2025:18149 Released 2025-10-15 · Red Hat rating Important.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.21-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.21-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.21-1.el9_6 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_6
- RHSA-2025:18148 Released 2025-10-15 · Red Hat rating Important.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.21-1.el8_10, aspnetcore-runtime-dbg-8.0-8.0.21-1.el8_10, aspnetcore-targeting-pack-8.0-8.0.21-1.el8_10 +9
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el8_10
Microsoft 2 updates
- Security Update
- .NET 9.0 installed on Linux 9.0.10
- .NET 9.0 installed on Mac OS 9.0.10
- .NET 9.0 installed on Windows 9.0.10
- ASP.NET Core 9.0 9.0.10
- Security Update
- .NET 8.0 installed on Linux 8.0.21
- .NET 8.0 installed on Mac OS 8.0.21
- .NET 8.0 installed on Windows 8.0.21
- ASP.NET Core 8.0 8.0.21
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Fixed | RHSA-2025:18256 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:18152, RHSA-2025:18153 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:18148, RHSA-2025:18150 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:18149, RHSA-2025:18151 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:18256 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2025:18148, RHSA-2025:18150 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2025:18152, RHSA-2025:18153 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2025:18149, RHSA-2025:18151 |
| Red Hat Hardened Images | Fixed | RHSA-2026:9080, RHSA-2026:9205 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 | Fixed | RHSA-2025:23225 |
Not affected: 2 products
- Red Hat Hardened Images
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.25
Microsoft
Microsoft's page for this CVE →
- Impact
- Security Feature Bypass
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| ASP.NET Core 2.3 | Fixed | 2.3.6 · Security Update |
| Microsoft Visual Studio 2022 version 17.10 | Fixed | 17.10.20 · Security Update |
| Microsoft Visual Studio 2022 version 17.12 | Fixed | 17.12.13 · Security Update |
| Microsoft Visual Studio 2022 version 17.14 | Fixed | 17.14.17 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55315
- 2026-10-03 Alias added: GHSA-5rrx-jjjq-q2r5
References
More Microsoft Asp.net Core vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2024-14164 .NET Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2023-18092 ASP.NET Core Denial of Service Vulnerability CVSS 3.1HIGH 8.2
- TI-2023-18392 ASP.NET Core Security Feature Bypass Vulnerability CVSS 3.1MEDIUM 6.2
- TI-2026-29147 ASP.NET Core Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.1
Sources
- CVE-2025-55315 · CVE Program
- CVE-2025-55315 · NVD
- FIRST EPSS
- GHSA-5rrx-jjjq-q2r5 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-55315 · Microsoft Security Update Guide
- CVE-2025-55315 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences