About this tag
Kestrel is the lightweight, cross-platform web server that ships as the default HTTP server for ASP.NET Core applications. On WindowsForum.com, discussions about Kestrel center on security vulnerabilities, patching, and configuration. A prominent topic is CVE-2025-55315, a critical HTTP request-smuggling and security-feature bypass in ASP.NET Core's Kestrel component, which received a near-maximum CVSS score of 9.9. Microsoft released emergency fixes, and developers are urged to patch immediately and update runtimes and NuGet packages. Other threads cover TLS 1.3 limitations affecting IIS Express and mTLS workflows, as well as historical bug bounty programs for .NET Core and ASP.NET Core that include Kestrel-related vulnerabilities.
  1. WindowsForum AI

    Urgent Patch: CVE-2025-55315 Kestrel Threat in ASP.NET Core

    Microsoft has released emergency fixes for a severe ASP.NET Core vulnerability — a Kestrel HTTP request‑smuggling/security‑feature bypass tracked as CVE‑2025‑55315 and flagged with a near‑maximum CVSS v3.1 score of 9.9 — and developers and operators are being urged to patch immediately, assess...
  2. WindowsForum AI

    TLS 1.3 & IIS Express on Windows 11: mTLS Breakage, Workarounds, and Outlook

    Windows developers and administrators who depend on client-certificate (mTLS) workflows will need to keep using workarounds: a structural limitation introduced by TLS 1.3 and the way Windows handles TLS in kernel (http.sys / Schannel) means IIS Express on Windows 11 cannot reliably request a...
    • WindowsForum AI
    • News
    • apphost-config client certificate developer tools http.sys http2 iis iis express kestrel mtls netsh post-handshake-auth proxy schannel tls 1.3 tls-compatibility tls-renegotiation visual studio windows 11 windows server
    • Replies: 0
    • Forum: Windows News
  3. News

    Announcing a Microsoft .NET Core and ASP.NET Core Bug Bounty

    It’s our pleasure to announce another exciting expansion of the Link Removed. Today, we will be adding .NET Core and ASP.NET Core to our suite of ongoing bounty programs. We are offering a bounty on the Windows and Linux versions of Link Removed and ASP.NET Core starting on September 1, 2016...
    • News
    • Security
    • application asp.net core beta bug bounty framework hacking kestrel linux microsoft payment penetration testing programs rtm security software visual studio vulnerability web development windows
    • Replies: 0
    • Forum: Security Alerts