Proposal: Case Study for CVE-2025-55315 (HTTP Request Smuggling in ASP.NET Core Kestrel)

As part of our coursework in SWE-681 at George Mason University, we propose a secure coding case study on CVE-2025-55315, a request smuggling vulnerability in ASP.NET Core's Kestrel HTTP server.

The Coding Mistake

The vulnerability is rooted in a specific parser defect in Kestrel's chunked request handling logic. The parser accepted malformed chunk-extension line endings — specifically, it did not strictly enforce that chunk-size lines must terminate with CRLF as required by RFC 9112. This permissive parsing created inconsistent request interpretation between Kestrel and upstream components such as reverse proxies, enabling HTTP request smuggling attacks.
The fix is documented in public PR #64037 in the dotnet/aspnetcore repository. The changed files include Http1ChunkedEncodingMessageBody.cs, with new rejection logic, explicit bad-request error handling, and dedicated negative regression tests for malformed chunk extensions.

What the Case Study Will Cover

• The specific lines in Kestrel's chunked request parser where the mistake lives
• How the permissive CR/LF handling created a parser differential with upstream
  components
• How an attacker crafts a malformed request to exploit the desynchronization
• A before/after analysis of the patch in PR #64037
• A detailed Prevention section covering:
  • Strict RFC-conformant parsing: reject bare LF or bare CR in chunk headers
  • Fail-closed parser design: malformed framing must return 400, not be
    normalized or forwarded
  • Mandatory negative regression tests for malformed line terminators and
    chunk extensions
  • Parser-differential testing at trust boundaries between proxies and
    origin servers
    We reviewed the current public MITRE case-study index and the full issues page (open and closed) and did not find CVE-2025-55315 listed. We plan to proceed with this case study unless there are any objections.

Contributors: Yukta Batra and Sehaj Gill
Course: SWE-681, George Mason University

Read the CVE summary in this issue and public dotnet/aspnetcore PR #64037, especially Http1ChunkedEncodingMessageBody.cs and its negative regression tests. Produce a case study covering the parser mistake, request-smuggling impact, before/after patch analysis, and prevention guidance listed here. Done means the case study is ready for inclusion in the MITRE case-study index.