"9.9 Critical"
It's not like these scores ever had a solid meaning, but throwing a 9.9 out there for this is nonsense.
It's just abusing an already weak system, making it that much weaker.
ASP.NET Security Feature Bypass Vulnerability
31–40 of 57 posts
Re: ASP.NET Security Feature Bypass Vulnerability
#32Isn't this only exploitable if you expose Kestrel to the internet? They (used to?) recommend to put a proxy in front of it so I would guess most deployments are done like that
Re: ASP.NET Security Feature Bypass Vulnerability
#33> If you are running .NET 8 or later install the .NET update from Microsoft Update, then restart your application or reboot the machine. This is why I advocate for .NET in serious business contexts. You often don't have to rebuild or redeploy your software if you are using the included batteries as intended. A devops intern could handle this fix. Contrast with virtually any other ecosystem.
Who doesn't use containers these days to deploy web apps?
Re: ASP.NET Security Feature Bypass Vulnerability
#34I guess this is the kind of CVE that will make CISOs in BigCorps scream "fix it now!!" to everyone down the chain, right?
Yes, because every one of our customers will be emailing me today with a questionnaire:
* Are we affected?
* What’s our timeline for fixing this?
* Have we asked all of our vendors the same questions?
(This doesn’t affect us in any way. If it did, I’d be scrambling to patch it so that our customers would relax.)
Re: ASP.NET Security Feature Bypass Vulnerability
#35FYI, the fixed versions were released yesterday, the 14th, in the October 2025 "Patch Tuesday"
at https://dotnet.microsoft.com/en-us/download/dotnet
They are 8.0.21 and 9.0.10
https://github.com/dotnet/core/blob/main/release-notes/8.0/8...
https://github.com/dotnet/core/blob/main/release-notes/9.0/9...
Re: ASP.NET Security Feature Bypass Vulnerability
#36Note that this affects ".net core", not ".net framework" https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
Yes, there is, because Microsoft naming sucks, and making the distiction between .NET Core and .NET Framework is the only way to actually explain modern .NET to most folks without background on .NET.
Additionally the mistake to rename .NET Core as .NET is the main reason many people still think .NET is Windows only.
Re: ASP.NET Security Feature Bypass Vulnerability
#37Note that this affects ".net core", not ".net framework" https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
Or you could say that this affects "recent versions of .NET". The "core" qualifier has largely been dropped now.
That started in .NET 5.0 in November 2020, which was nearly 5 years ago now.
Re: ASP.NET Security Feature Bypass Vulnerability
#38I'm entirely confused. Am I right to assume that the actual exploit isn't published yet and still under embargo? Or am I missing some explanation of the actual issue here?
The fix was released 14 October 2025, in the "patch Tuesday" release.
There are links to the fix code change in these threads, and a sufficiently determined person could work from that to find the vulnerability. So any embargo is likely expiring now.
Re: ASP.NET Security Feature Bypass Vulnerability
#39Is this another instance of HTTP desync?
Re: ASP.NET Security Feature Bypass Vulnerability
#40Earlier quoted context omitted.
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
Yes, there is, because Microsoft naming sucks, and making the distiction between .NET Core and .NET Framework is the only way to actually explain modern .NET to most folks without background on .NET. Additionally the mistake to rename .NET Core as .NET is the main reason many people still think .NET is Windows only.
Well they did have a valid reason for a rename, .NET 5.0's announcement coincided with discontinuing Mono and Xamarin, and uniting the non-Windows .NET flavors under a single platform. They also planned to iterate more rapidly and add APIs beyond .NET Standard.
But yes, choosing ".NET" as the new name was a bad idea, since now when someone says .NET you have no idea if they are referring to the modern runtime, or its various generations collectively.