
- CVE-2025-55315 enables HTTP request smuggling in ASP.NET Core’s Kestrel web server
- Attackers can bypass controls, access credentials, alter files, or crash the server
- Microsoft released updates for affected .NET and Visual Studio versions to mitigate the flaw
Microsoft has confirmed it recently fixed its “highest ever” vulnerability plaguing its ASP.NET Core product.