CVE-2025-55315

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions prior to 10.0.0-rc.2.25502.107 ASP.NET Core versions prior to 9.0.10 ASP.NET Core versions prior to 8.0.21 Microsoft.AspNetCore.Server.Kestrel.Core versions prior to 2.3.6

Description Inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling, in ASP.NET Core allows an authorized attacker to bypass security features over a network. The issue stems from how the Kestrel server handles chunked transfer encoding and misinterprets HTTP boundaries under certain conditions. This can enable attackers to hide a second HTTP request inside another, bypassing proxies or header parsing. Potential impacts include privilege escalation, authenticated bypasses, Server-Side Request Forgery (SSRF), Cross-Site Request Forgery (CSRF) bypass, injection, and unauthorized access to internal APIs. Over 46.3 million instances have been detected worldwide. This flaw also affects QNAP's NetBak PC Agent, where it could lead to unauthorized data access and server disruptions.

Recommendations For ASP.NET Core 10.0, update to version 10.0.0-rc.2.25502.107 or later. For ASP.NET Core 9.0, update to version 9.0.10 or later. For ASP.NET Core 8.0, update to version 8.0.21 or later. For applications using the Microsoft.AspNetCore.Server.Kestrel.Core package, update to version 2.3.6. For QNAP NetBak PC Agent users, perform a reinstallation of the software to ensure updated components are applied.