Microsoft Patches Highest-Severity ASP.NET Core Flaw to Date

This week, Microsoft addressed a critical vulnerability in the Kestrel ASP.NET Core web server—one that’s earned the highest severity rating ever recorded for the platform. The flaw, tracked as CVE-2025-55315, is an HTTP request smuggling bug that could allow authenticated attackers to hijack user sessions, bypass security controls, and potentially crash servers.

For developers and security teams, this isn’t just another patch—it’s a wake-up call.

What makes CVE-2025-55315 so dangerous?

• Request smuggling: Attackers can inject a second HTTP request into a legitimate one, confusing the server and bypassing front-end protections.
• Impact scope: Exploitation could lead to credential theft, unauthorized file changes, and denial-of-service attacks.
• Severity rating: Microsoft scored this flaw with the worst-case scenario in mind—privilege escalation, CSRF bypass, and server-side request forgery (SSRF) are all possible depending on how the app is coded.

Barry Dorrans, .NET Security Technical Program Manager, emphasized that while the worst-case impact may not be likely for all apps, the risk is real enough to warrant immediate action:

“We score with the worst possible case in mind… please go update.”

Who’s affected and what to do

Microsoft has released patches across multiple versions and platforms:

• .NET 8 or later: Install the update via Microsoft Update, then restart your app or reboot.
• .NET 2.3: Update Microsoft.AspNet.Server.Kestrel.Core to version 2.3.6, recompile, and redeploy.
• Self-contained/single-file apps: Install the update, recompile, and redeploy.
• Visual Studio 2022 and ASP.NET Core 2.3, 8.0, 9.0: Security updates are available now.

Strategic takeaways for security teams

• Patch velocity matters: This flaw underscores the importance of timely updates, especially for web-facing services.
• Code hygiene is critical: The exploitability of this bug depends on how your app handles requests—review your input validation, authentication flows, and CSRF protections.
• Defense in depth: Consider additional layers like web application firewalls (WAFs), reverse proxies, and request inspection tools to mitigate smuggling risks.
• Monitor for anomalies: Watch for unusual request patterns, session hijacking attempts, and internal requests that bypass expected flows.

Final thoughts

This isn’t just a technical issue—it’s a reminder of how fragile trust can be in modern web applications. When a single malformed request can bypass security controls and impersonate users, it’s time to revisit your threat models and patching discipline. Microsoft’s swift response is commendable, but the responsibility to secure your stack lies with you.

Patch now. Review your code. And treat every request as a potential risk until proven safe.