The advisory from Red Hat Product Security covers a security update for Red Hat Hardened Images RPMs, including numerous dotnet9.0-related packages for aarch64 and x86_64. It addresses multiple CVEs, including CVE-2025-55315, which is a flaw in ASP.NET Core's HTTP request parsing that can be exploited by an authorized network attacker to perform HTTP request smuggling. This vulnerability can lead to bypassing security controls and unintended forwarding of request data. The advisory states that .NET 6.0 for RHEL-8, RHEL-9, and RHIVOS has reached end of life and will not receive fixes. Mitigations for the HTTP request smuggling issue are either unavailable or insufficient per Red Hat's criteria. The advisory does not explicitly confirm patch availability for the vulnerabilities but provides updated RPM packages as part of the update. Multiple related CVEs are referenced, but no CVSS scores are provided. Red Hat remains the authoritative source for impact and remediation status.

The primary impact involves potential bypass of security controls via HTTP request smuggling in ASP.NET Core, allowing an authorized network attacker to manipulate request boundaries. This can lead to exposure or unauthorized actions on request data. The advisory indicates high confidentiality impact and low integrity impact for this vulnerability. Other vulnerabilities covered by the advisory are not detailed in terms of impact. No known exploits in the wild are reported. The advisory also notes that some affected product streams (.NET 6.0 for certain Red Hat platforms) are no longer supported and will not receive fixes.

The vendor advisory states that mitigation for the HTTP request smuggling vulnerability is either not available or does not meet Red Hat's criteria for ease of use, deployment, applicability, or stability. No official fix or patch is explicitly confirmed in the advisory. Users are advised to refer to the provided updated RPM packages and Red Hat's official update channels for applying this update. For unsupported product streams, no fixes will be provided, and upgrading to supported versions is recommended. Customers with Red Hat Technical Account Managers can seek direct guidance. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.