CVE-2025-55248

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gwq6-fmvp-qp68. This link is maintained to preserve external references.

Original Description

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

Microsoft Security Advisory CVE-2025-55248 | .NET Information Disclosure Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A MITM (man in the middle) attacker may prevent use of TLS between client and SMTP server, forcing client to send data over unencrypted connection.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/372

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

• Any .NET 8.0 application running on .NET 8.0.20 or earlier.
• Any .NET 9.0 application running on .NET 9.0.9 or earlier.

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below

<a name=".NET 9"></a>.NET 9

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NetCore.App.Runtime.linux-arm | >= 9.0.0, < =9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.NetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.9 | 9.0.10

<a name=".NET 8"></a>.NET 8

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.NetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.NetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21…

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

It was discovered that .NET did not properly handle the creation of temporary build time directories. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-55247)

It was discovered that .NET did not properly establish TLS sessions for SMTP server connections. An attacker could use this issue to cause .NET to use unencrypted connections. This issue only affects .NET versions 8.0 and 9.0. (CVE-2025-55248)

It was discovered that .NET inconsistently interpreted certain http requests. An attacker could possibly use this to bypass a security feature over a network. (CVE-2025-55315)