Microsoft has released patches for a critical HTTP request smuggling vulnerability affecting the Kestrel web server in ASP.NET Core, marking the framework’s highest-ever CVSS score at 9.9/10. The flaw tracked as CVE-2025-55315, allows attackers to embed a hidden HTTP request within another, potentially bypassing authentication, hijacking user credentials, leaking sensitive data, tampering with files, or triggering denial-of-service (DoS) conditions. The vulnerability’s real-world impact depends heavily on how each application is developed and deployed, particularly whether reverse proxies strip smuggled requests and whether proper validation checks exist. Microsoft’s security program manager Barry Dorrans emphasized that, while the worst-case scenario involves a full security feature bypass enabling privilege escalation or injection attacks, exploitation is unlikely unless applications contain flawed request-handling logic. The vulnerability affects all supported ASP.NET Core versions, including 2.3, 8.0, 9.0, and the 10.0 pre-release, as well as Visual Studio 2022 (versions 17.10–17.14). CTIX analysts urge immediate patching via .NET updates or by upgrading to Kestrel.Core version 2.3.6, understanding that the vulnerability is not yet known to have been exploited but poses serious risk if left unmitigated.