
Tool that reproduces CVE-2025-55315 in ASP.NET Core.
This repository contains a small ASP.NET Core console app to reproduce and exercise HTTP chunked-transfer and newline parsing behavior.
More information on CVE-2025-55315.
Repro/Program.cs - Console app that starts a local Kestrel server and runs two TCP-based tests. The tests send raw HTTP bytes over a TcpClient to exercise chunked transfer parsing and invalid newline handling across fragmented reads.
If these tests fail, you are vulernable to CVE-2025-55315 and need to update your version of .NET (versions 8, 9, and 10) or obtain post-EOL support for .NET (version 6) from HeroDevs.
.NET SDK 6+
git clone https://github.com/sirredbeard/CVE-2025-55315-repro
cd CVE-2025-55315-repro
dotnet build CVE-2025-55315-repro.sln --framework net6.0
dotnet run --project Repro/Repro.csproj --configuration Debug --framework net6.0