RN200958: Security Advisory: ASP.NET Core Vulnerability (CVE-2025-55315)

Date: 16 October 2025 
Status: Patch Available - Impact Under Assessment 
Severity: Critical 
Reference: GitHub Advisory GHSA-5rrx-jjjq-q2r5

Overview

Microsoft has disclosed and patched a critical vulnerability in the ASP.NET Core framework, identified as GHSA-5rrx-jjjq-q2r5 / CVE-2025-55315. 
The issue involves a security feature bypass that may lead to HTTP request/response smuggling under certain configurations. The vulnerability resides in Microsoft’s ASP.NET Core runtime - a component widely used across the software industry in .NET-based web applications.

More information about ASP.NET Core: https://dotnet.microsoft.com/en-us/apps/aspnet

The vulnerability was introduced within the Microsoft ASP.NET Core platform itself and is not specific to our products. Raynet assessed the applicability on our products and determined, they may be using the vulnerable component (see Impact on Our Products).

At the time of reporting, the vulnerability has been assigned a score of 9.9/10 (CVSS).

Impact on Our Products

Some of our applications are built on ASP.NET Core runtimes that may fall within the affected versions. We conducted a comprehensive impact analysis to determine whether any of our deployed or distributed systems are running vulnerable runtime versions.

The following products / components can be affected:

• Raynet One (all versions)
• Raynet One Technology Catalog (14.0, 14.1, 2025.3)
• Raynet One Data Hub (14.0, 14.1, 2025.3)
• Raynet One UEM (3.1, 3.2)

The following products are not affected:

• RMSi
• RayPack Studio (RayPack, RayQC, RayQC Advanced, PackBench, RayEval)
• RayFlow
• RaySAMi
• RayVentory Data Hub / Raynet One Data Hub (versions 12.5, 12.6)*
• RayVentory Catalog / Raynet One Technology Catalog (versions 12.5, 12.6)*

* According to official vendor statement, ASP.NET Core frameworks used by Raynet One and RayVentory products, versions 12.5 and 12.6 are not affected by CVE-2025-55315.

Customer Guidance

• Customers managing their own runtime environments (Windows / IIS) with any of affected products are advised to update to the patched versions of ASP.NET Core (8.0.21, 9.0.10, or newer) following Microsoft’s standard update procedures. We also recommend to remove affected versions of frameworks by uninstalling them completely.
• Customers managing their own runtime environments (Docker / Kubernetes) with any of affected products are advised to update to the patched versions of our Docker images, following the product update guide table.
  • See table Patch Availability (Windows)
• Customers using Raynet-managed environments do not need to take any action. Raynet will ensure the timely introduction of patched code/images without interrupting service.
  • See table Patch Availability (Docker)
• Currently, there is no evidence of exploitation within our environment or customer installations.

Patch Availability (Windows)

Microsoft has released security updates addressing this vulnerability in the following runtime versions:

All newer versions include the security fix.

IT Administrators should update the ASP.NET Core framework to the newest version, and then restart server instances (IIS Applications). No further steps are required.

According to the official vendor recommendation, previous versions of ASP.NET Core (prior to 8.0) are not affected.

Patch Availability (Docker)

Raynet released updated Docker images, which should replace all previously used. The following table shows the list of affected versions, and the suggested migration paths to rectify the vulnerability.

Raynet One

The newest version available which fixes the vulnerability is 2025.3 Update 2 (version 25.3.3667.63). For customers still using the 1.x product line, we also offer a dedicated Update 5 (version 1.1.3035.65).

Note: Versions prior to 1.1 are not supported anymore.

Raynet One Data Hub

There are four different product lines with separate patches:

• For users staying on 14.0 product line, Update 2 (version 14.0.5957.216) resolves the vulnerability.
• For users on product line 14.1, two patches are available, due to breaking changes introduced in Update 3.
  • Builds earlier than Update 3 should be updated with Hotfix 1 for 14.1 Update 2 (version 14.1.6310.219)
  • Newer versions (from Update 3 on) should be updated to Update 5 (version 14.1.6351.217)
• Product line 2025.3 should be updated to Update 1 (25.3.6846.218)

Note: Versions prior to 14.0 are not supported anymore.

* According to official vendor statement, ASP.NET Core frameworks used by versions 12.5 and 12.6 are not affected by CVE-2025-55315.

Raynet One Technology Catalog

All versions of Raynet One Technology Catalog should be updated to the newest Hotfix 1 for 2025.3 Update 1 (version 25.3.3871.124)

Note: Versions prior to 14.0 are not supported anymore.

* According to official vendor statement, ASP.NET Core frameworks used by versions 12.5 and 12.6 are not affected by CVE-2025-55315.

Raynet One UEM

All versions of Raynet One UEM should be updated to the newest version 3.2 Update 2 (version 3.2.4222.794)

Note: Versions prior to 3.1 are not supported anymore.

Current Actions

1. Remediation Planning
   For any confirmed instances, we will apply the patched runtime versions and issue corresponding product updates on Raynet-managed instances (Cloud, SaaS).
2. Monitoring
   Our SOC continues to monitor for any signs of exploitation attempts or related anomalies.
3. Coordination with Microsoft:
   We are aligning our mitigation activities with Microsoft’s official guidance and release notes.
4. Communication
   We will contact customers with their own hosting platforms and advise them on the mitigation strategy.

Contact

Product Security Response Team (PSRT) 
cert@raynet.de

History of changes

• 16.10.2025
  Initial assessment and first version of this page.
• 17.10.2025
  Added information about affected products and their newest patches. Updated customer guidance. Based on preliminary information, versions 12.5 and 12.6 of Raynet One Data Hub and Raynet One Technology Catalog are not affected.