Microsoft ASP.NET: CVE-2025-55315: HTTP Request Smuggling Vulnerability

A critical vulnerability exists in the ASP.NET Core Kestrel web server due to an inconsistent interpretation of HTTP requests (Request Smuggling). The flaw stems from improper validation of chunked transfer encoding extensions and newline handling.

An authenticated attacker can exploit this discrepancy between a reverse proxy (like Nginx, HAProxy, or Azure Front Door) and the backend Kestrel server to "smuggle" a hidden request within a legitimate one. Successfully exploiting this allows bypassing security features such as authentication, authorization, and CSRF checks.