CVE-2025-55315 — ASP.NET Security Feature Bypass Vulnerability

Description

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	ASP.NET Core 2.3	2.3 – < 2.3.6	2.3.6
Microsoft	ASP.NET Core 8.0	8.0 – < 8.0.21	8.0.21
Microsoft	ASP.NET Core 9.0	9.0 – < 9.0.10	9.0.10
Microsoft	Microsoft Visual Studio 2022 version 17.10	17.10.0 – < 17.10.20	17.10.20
Microsoft	Microsoft Visual Studio 2022 version 17.12	17.12.0 – < 17.12.13	17.12.13
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0 – < 17.14.17	17.14.17

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	dotnet10	10.0.100-10.0.0~rc2-0ubuntu1	—
Ubuntu 25.10	dotnet10	10.0.100-10.0.0~rc2-0ubuntu1~25.10.2	USN-7822-1
Ubuntu 25.10	dotnet8	8.0.121-8.0.21-0ubuntu1~25.10.1	USN-7822-1
Ubuntu 25.10	dotnet9	9.0.111-9.0.10-0ubuntu1~25.10.1	USN-7822-1
Ubuntu 24.04 LTS	dotnet10	10.0.100-10.0.0-0ubuntu1~24.04.1	—
Ubuntu 24.04 LTS	dotnet8	8.0.121-8.0.21-0ubuntu1~24.04.1	USN-7822-1
Ubuntu 22.04 LTS	dotnet6 +1	No fix yet	—
Ubuntu 22.04 LTS	dotnet8	8.0.121-8.0.21-0ubuntu1~22.04.1	USN-7822-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	dotnet-host +8	9.0.10-1.el10_0	RHSA-2025:18153, RHBA-2025:20993
RHEL 10	dotnet-hostfxr-10.0 +7	10.0.0~rc.2.25502.107-0.12.el10_1	RHBA-2025:20993
RHEL 10	dotnet-hostfxr-8.0 +7	8.0.21-1.el10_0	RHSA-2025:18152
RHEL 10	dotnet10.0 +5	10.0.100~rc.2.25502.107-0.12.el10_1	RHBA-2025:20993
RHEL 10	dotnet8.0 +4	8.0.121-1.el10_0	RHSA-2025:18152
RHEL 10	dotnet9.0 +6	9.0.111-1.el10_0	RHSA-2025:18153
RHEL 9	dotnet-host +8	9.0.10-1.el9_6	RHSA-2025:18151, RHBA-2025:20916
RHEL 9	dotnet-hostfxr-10.0 +7	10.0.0~rc.2.25502.107-0.10.el9_7	RHBA-2025:20916
RHEL 9	dotnet-hostfxr-8.0 +7	8.0.21-1.el9_6	RHSA-2025:18149
RHEL 9	dotnet10.0 +5	10.0.100~rc.2.25502.107-0.10.el9_7	RHBA-2025:20916
RHEL 9	dotnet8.0 +4	8.0.121-1.el9_6	RHSA-2025:18149
RHEL 9	dotnet9.0 +6	9.0.111-1.el9_6	RHSA-2025:18151
RHEL 8	dotnet +7	9.0.111-1.el8_10	RHSA-2025:18150
RHEL 8	dotnet-host +8	9.0.10-1.el8_10	RHSA-2025:18150
RHEL 8	dotnet-hostfxr-8.0 +7	8.0.21-1.el8_10	RHSA-2025:18148
RHEL 8	dotnet8.0 +4	8.0.121-1.el8_10	RHSA-2025:18148

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.4 EUS	dotnet-host +8	8.0.21-1.el9_4	RHSA-2025:18256
RHEL 9.4 EUS	dotnet8.0 +5	8.0.121-1.el9_4	RHSA-2025:18256
Red Hat Hardened Images 1	dotnet8.0	8.0.126-1.hum1	RHSA-2026:9080
Red Hat Hardened Images 1	dotnet9.0	9.0.116-1.hum1	RHSA-2026:9205

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	dotnet-host +8	9.0.10-1.el10_0	ALSA-2025:18153
AlmaLinux 10	dotnet-hostfxr-8.0 +7	8.0.21-1.el10_0	ALSA-2025:18152
AlmaLinux 10	dotnet-sdk-8.0 +3	8.0.121-1.el10_0	ALSA-2025:18152
AlmaLinux 10	dotnet-sdk-9.0 +5	9.0.111-1.el10_0	ALSA-2025:18153
AlmaLinux 9	dotnet-host +8	9.0.10-1.el9_6	ALSA-2025:18151
AlmaLinux 9	dotnet-hostfxr-8.0 +7	8.0.21-1.el9_6	ALSA-2025:18149
AlmaLinux 9	dotnet-sdk-8.0 +3	8.0.121-1.el9_6	ALSA-2025:18149
AlmaLinux 9	dotnet-sdk-9.0 +5	9.0.111-1.el9_6	ALSA-2025:18151
AlmaLinux 8	dotnet +6	9.0.111-1.el8_10	ALSA-2025:18150
AlmaLinux 8	dotnet-host +8	9.0.10-1.el8_10	ALSA-2025:18150
AlmaLinux 8	dotnet-hostfxr-8.0 +7	8.0.21-1.el8_10	ALSA-2025:18148
AlmaLinux 8	dotnet-sdk-8.0 +3	8.0.121-1.el8_10	ALSA-2025:18148

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	dotnet8.0	8.0.121-1.el10_0	RLSA-2025:18152
Rocky Linux 10	dotnet9.0	9.0.111-1.el10_0	RLSA-2025:18153
Rocky Linux 9	dotnet8.0	8.0.121-1.el9_6	RLSA-2025:18149
Rocky Linux 9	dotnet9.0	9.0.111-1.el9_6	RLSA-2025:18151
Rocky Linux 8	dotnet8.0	8.0.121-1.el8_10	RLSA-2025:18148
Rocky Linux 8	dotnet9.0	9.0.111-1.el8_10	RLSA-2025:18150

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	dotnet8-runtime	8.0.21-r0	—
Alpine v3.24	dotnet9-runtime	9.0.10-r0	—
Alpine v3.23	dotnet8-runtime	8.0.21-r0	—
Alpine v3.23	dotnet9-runtime	9.0.10-r0	—
Alpine v3.22	dotnet8-runtime	8.0.21-r0	—
Alpine v3.22	dotnet9-runtime	9.0.10-r0	—
Alpine v3.21	dotnet8-runtime	8.0.21-r0	—
Alpine v3.21	dotnet9-runtime	9.0.10-r0	—
Alpine v3.20	dotnet8-runtime	8.0.21-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	dotnet +5	8.0.121-1.amzn2023.0.1	ALAS2023-2025-1231, ALAS2023-2025-1230
Amazon Linux 2023	dotnet-host +8	8.0.21-1.amzn2023.0.1	ALAS2023-2025-1231, ALAS2023-2025-1230
Amazon Linux 2023	dotnet-hostfxr-9.0 +7	9.0.10-1.amzn2023.0.1	ALAS2023-2025-1231
Amazon Linux 2023	dotnet-sdk-9.0 +4	9.0.111-1.amzn2023.0.1	ALAS2023-2025-1231

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	dotnet-host +8	9.0.10-1.0.1.el10_0	ELSA-2025-18153
Oracle Linux 10	dotnet-hostfxr-8.0 +7	8.0.21-1.0.1.el10_0	ELSA-2025-18152
Oracle Linux 10	dotnet-sdk-8.0 +3	8.0.121-1.0.1.el10_0	ELSA-2025-18152
Oracle Linux 10	dotnet-sdk-9.0 +5	9.0.111-1.0.1.el10_0	ELSA-2025-18153
Oracle Linux 9	dotnet-host +8	9.0.10-1.0.1.el9_6	ELSA-2025-18151
Oracle Linux 9	dotnet-hostfxr-8.0 +7	8.0.21-1.0.1.el9_6	ELSA-2025-18149
Oracle Linux 9	dotnet-sdk-8.0 +3	8.0.121-1.0.1.el9_6	ELSA-2025-18149
Oracle Linux 9	dotnet-sdk-9.0 +5	9.0.111-1.0.1.el9_6	ELSA-2025-18151
Oracle Linux 8	dotnet +6	9.0.111-1.0.1.el8_10	ELSA-2025-18150
Oracle Linux 8	dotnet-host +8	9.0.10-1.0.1.el8_10	ELSA-2025-18150
Oracle Linux 8	dotnet-hostfxr-8.0 +7	8.0.21-1.0.1.el8_10	ELSA-2025-18148
Oracle Linux 8	dotnet-sdk-8.0 +3	8.0.121-1.0.1.el8_10	ELSA-2025-18148

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	dotnet-8	8.0.121-r0	—
Wolfi rolling	dotnet-9	9.0.111-r0	—
Wolfi rolling	dotnet-bootstrap-8	8.0.122-r0	—
Wolfi rolling	dotnet-bootstrap-9	9.0.112-r0	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

ASP.net 8.0.10 - Bypass EDB-52492 · webapps · Apr 6, 2026

GitHub 7 repositories

sirredbeard/CVE-2025-55315-repro ★ 46 · Oct 16, 2025

Tool that reproduces CVE-2025-55315 in ASP.NET Core.
ZemarKhos/CVE-2025-55315-PoC-Exploit ★ 10 · Nov 11, 2025

CVE-2025-55315 PoC Exploit
nickcopi/CVE-2025-55315-detection-playground ★ 7 · Oct 16, 2025

Playground to experiment with different behavior on patched/unpatched Kestrel for the CVE-2025-55315 HTTP smuggling vulnerability
7huukdlnkjkjba/CVE-2025-55315- ★ 6 · Oct 19, 2025

专业级HTTP请求走私漏洞利用与自动化渗透测试工具
jlinebau/CVE-2025-55315-Scanner-Monitor ★ 2 · Oct 24, 2025

Quick and Simple Scripts to Scan for Vulnerable Servers and Packet Level Monitors
MartinFabianIonut/CVE-2025-55315 ★ 1 · Nov 27, 2025

Proof-of-concept exploit for CVE-2025-55315 (.NET HTTP Request Smuggling). Demonstrates how improperly parsed chunked encoding lets attackers smuggle requests past proxies and load balancers in vulne…
NetVanguard-cmd/CVE-2025-55315 ★ 0 · Apr 19, 2026

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.linux-x64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.osx-x64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-arm64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-x64	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 10.0.0-rc.1.25451.107, < 10.0.0-rc.2.25502.107	10.0.0-rc.2.25502.107	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 9.0.0, < 9.0.10	9.0.10	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.App.Runtime.win-x86	>= 8.0.0, < 8.0.21	8.0.21	GHSA-5rrx-jjjq-q2r5
NuGet	Microsoft.AspNetCore.Server.Kestrel.Core	< 2.3.6	2.3.6	GHSA-5rrx-jjjq-q2r5

Advisories 37

ALSA-2025:18152 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:18153 Important: .NET 9.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:18149 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:18151 Important: .NET 9.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:18148 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:18150 Important: .NET 9.0 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:9205 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
RHSA-2026:9080 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
RHSA-2025:18256 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHSA-2025:18153 Red Hat Security Advisory: .NET 9.0 security update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHSA-2025:18152 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHSA-2025:18150 Red Hat Security Advisory: .NET 9.0 security update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHSA-2025:18151 Red Hat Security Advisory: .NET 9.0 security update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHSA-2025:18148 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHSA-2025:18149 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHBA-2025:20993 Red Hat Bug Fix Advisory: .NET 10.0 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jul 4, 2026
RHBA-2025:20916 Red Hat Bug Fix Advisory: .NET 10.0 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jul 4, 2026
USN-7822-1 dotnet8, dotnet9, dotnet10 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
WID-SEC-2025-2278 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
VDE-2026-010 WAGO: Multiple Vulnerabilities in WAGO Solution Builder and WAGO Device Sphere CERT@VDE · Mar 30, 2026
VDE-2026-001 METTLER TOLEDO: ASP.NET core vulnerability in LabX CERT@VDE · Mar 4, 2026
ALAS2023-2025-1230 Critical: dotnet8.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 23, 2025
ALAS2023-2025-1231 Critical: dotnet9.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 23, 2025
MSRC-CVE-2025-55315 ASP.NET Security Feature Bypass Vulnerability Microsoft Security Response Center · Oct 22, 2025
RLSA-2025:18153 Important: .NET 9.0 security update Rocky Linux Security Advisories · Oct 18, 2025
RLSA-2025:18151 Important: .NET 9.0 security update Rocky Linux Security Advisories · Oct 18, 2025
RLSA-2025:18152 Important: .NET 8.0 security update Rocky Linux Security Advisories · Oct 18, 2025
RLSA-2025:18149 Important: .NET 8.0 security update Rocky Linux Security Advisories · Oct 18, 2025
RLSA-2025:18148 Important: .NET 8.0 security update Rocky Linux Security Advisories · Oct 17, 2025
RLSA-2025:18150 Important: .NET 9.0 security update Rocky Linux Security Advisories · Oct 17, 2025
ELSA-2025-18153 Important: .NET 9.0 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
ELSA-2025-18152 Important: .NET 8.0 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
ELSA-2025-18151 Important: .NET 9.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
ELSA-2025-18149 Important: .NET 8.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
ELSA-2025-18150 Important: .NET 9.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
ELSA-2025-18148 Important: .NET 8.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 16, 2025
NCSC-2025-0313 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · Oct 14, 2025

References

ASP.NET Security Feature Bypass Vulnerability vendor-advisory patch

CNA	v3.1	9.9
EUVD	v3.1	9.9
OSV:GHSA	v3.1	9.9