CVE-2025-55315

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

References

Affected packages

Git / github.com/dotnet/aspnetcore

Affected ranges

Type

GIT

Repo

https://github.com/dotnet/aspnetcore

Events

Introduced

3f1acb59718cadf111a0a796681e3d3509bb3381

Fixed

6254f5ca64f85b90327592dff67ea6b2ec0262c6

Introduced

af22effae4069a5dfb9b0735859de48820104f5b

Fixed

5bae930797f60d2d04f3b1df6a33eaca85fc5f28

Database specific

{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.21"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.10"
        }
    ]
}

Affected versions

v8.*

v8.0.0

v8.0.1

v8.0.10

v8.0.11

v8.0.12

v8.0.13

v8.0.14

v8.0.15

v8.0.16

v8.0.17

v8.0.18

v8.0.19

v8.0.2

v8.0.20

v8.0.3

v8.0.4

v8.0.5

v8.0.7

v8.0.8

v9.*

v9.0.0

v9.0.1

v9.0.2

v9.0.3

v9.0.4

v9.0.5

v9.0.6

v9.0.7

v9.0.8

v9.0.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-55315.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "2.3.0"
            },
            {
                "fixed": "2.3.6"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "17.10.0"
            },
            {
                "fixed": "17.10.20"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "17.12.10"
            },
            {
                "fixed": "17.12.13"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "17.14.0"
            },
            {
                "fixed": "17.14.17"
            }
        ]
    }
]