CVE Scan for emberstack/kubernetes-reflector:9.1.30

Docker image vulnerability scanner

22 Known Vulnerabilities in this Docker Image

Critical

High

Medium

Low

Info/ Unspecified/ Unknown

CVE ID Severity Package Affected Version Fixed Version CVSS Score

CVE-2025-55315 critical pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.8 >=9.0.0,<=9.0.9 9.0.10 9.9

Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 10.0 , ASP.NET Core 9.0 , ASP.NET Core 8.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/announcements/issues/371

Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

Affected software

Any ASP.NET Core 10.0 application running on ASP.NET Core 10.0.0-rc.1.25451.107 or earlier.
Any ASP.NET Core 9.0 application running on ASP.NET Core 9.0.9 or earlier.
Any ASP.NET Core application running on ASP.NET Core 8.0.20 or earlier.
Any ASP.NET Core 2.x application consuming the package Microsoft.AspNetCore.Server.Kestrel.Core version 2.3.0 or earlier.

Affected Packages

The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

Package name	Affected version	Patched version
Microsoft.AspNetCore.Server.Kestrel.Core	<= 2.3.0	2.3.6

ASP.NET Core 10

Package name	Affected version	Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.linux-arm64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.linux-x64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.osx-arm64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.osx-x64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.win-arm	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.win-arm64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.win-x64	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107
Microsoft.AspNetCore.App.Runtime.win-x86	10.0.0-rc.1.25451.107	10.0.0-rc.2.25502.107

ASP.NET Core 9

Package name	Affected version	Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.linux-x64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.osx-x64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.win-arm	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.win-arm64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.win-x64	>= 9.0.0, <= 9.0.9	9.0.10
Microsoft.AspNetCore.App.Runtime.win-x86	>= 9.0.0, <= 9.0.9	9.0.10

ASP.NET Core 8

Package name	Affected version	Patched version
Microsoft.AspNetCore.App.Runtime.linux-arm	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.linux-arm64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.linux-x64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.osx-arm64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.osx-x64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.win-arm	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.win-arm64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.win-x64	>= 8.0.0, <= 8.0.20	8.0.21
Microsoft.AspNetCore.App.Runtime.win-x86	>= 8.0.0, <= 8.0.20	8.0.21

Advisory FAQ

How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software or affected packages, you're exposed to the vulnerability.

How do I fix the issue?

To fix the issue please install the latest version of .NET 9.0 and .NET 8.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
If your application references the vulnerable package, update the package reference to the patched version.

You can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET SDK:
 Version:           9.0.100
 Commit:            59db016f11
 Workload version:  9.0.100-manifests.3068a692
 MSBuild version:   17.12.7+5b8665660

Runtime Environment:
 OS Name:     Mac OS X
 OS Version:  15.2
 OS Platform: Darwin
 RID:         osx-arm64
 Base Path:   /usr/local/share/dotnet/sdk/9.0.100/

.NET workloads installed:
There are no installed workloads to display.
Configured to use loose manifests when installing new manifests.

Host:
  Version:      9.0.0
  Architecture: arm64
  Commit:       9d5a6a9aa4

.NET SDKs installed:
  9.0.100 [/usr/local/share/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
  x64   [/usr/local/share/dotnet]
    registered at [/etc/dotnet/install_location_x64]

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

If you're using .NET 8.0, you should download and install .NET 8.0.21 Runtime or .NET 8.0.318 SDK (for Visual Studio 2022 v17.10 latest update) from https://dotnet.microsoft.com/download/dotnet-core/8.0.
If you're using .NET 9.0, you should download and install .NET 9.0.10 Runtime or .NET 9.0.111 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/9.0.
If you're using .NET 10.0, you should download and install .NET 10.0.0-rc.2.25476.107 Runtime or .NET 10.0.100-rc.2.25476.107 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/10.0.
If you're using Microsoft.AspNetCore.Server.Kestrel.Core nuget package, update to the latest version 2.3.6 using either of the following methods:
- Using the NuGet Package Manager UI in Visual Studio: - Open your project in Visual Studio. - Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". - In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. - Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. - Click the "Update" button.
- Using the NuGet Package Manager Console in Visual Studio: - Open your project in Visual Studio. - Navigate to "Tools > NuGet Package Manager > Package Manager Console". - To update a specific package to its latest version, use the Update-Package command: Code: Update-Package -Id Microsoft.AspNetCore.Server.Kestrel.Core
- Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version: Code: dotnet add package Microsoft.AspNetCore.Server.Kestrel.Core

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 8.0, .NET 9.0 or .NET 10.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

Acknowledgement

Sid

CVE-2025-55315

Revisions

V1.0 (October 14, 2025): Advisory published.

Version 1.0

Last Updated 2025-10-14

Relevance:

The CVE-2025-55315 is only relevant if the emberstack/kubernetes-reflector:9.1.30 image interacts with untrusted input or exposes APIs to external networks. It becomes critical in multi-tenant Kubernetes environments where malicious actors could exploit it to escalate privileges or access sensitive data. For isolated or internal use with trusted workloads, the risk is minimal. (Note: Relevance analysis is automatically generated and may require verification.)

Package URL(s):

pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@9.0.8

More Info (NVD):

https://nvd.nist.gov/vuln/detail/CVE-2025-55315

CVE-2023-31484 high perl <5.36.0-7+deb12u3 5.36.0-7+deb12u3 8.1

CVE-2025-4802 high glibc <2.36-9+deb12u11 2.36-9+deb12u11 7.8

CVE-2025-9230 high openssl <3.0.17-1~deb12u3 3.0.17-1~deb12u3 7.5

CVE-2025-9708 medium pkg:nuget/KubernetesClient@17.0.4 <17.0.14 17.0.14 6.8

CVE-2025-8058 medium glibc <2.36-9+deb12u13 2.36-9+deb12u13 5.9

CVE-2025-40909 medium perl <5.36.0-7+deb12u3 5.36.0-7+deb12u3 5.9

CVE-2025-55248 medium pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@9.0.8 >=9.0.0,<=9.0.9 9.0.10 5.7

CVE-2025-45582 medium tar >=1.34+dfsg-1.2+deb12u1 not fixed 4.1

CVE-2025-27587 low openssl >=3.0.17-1~deb12u2 not fixed 3.1

Severity Levels

Exploitation could lead to severe consequences, such as system compromise or data loss. Requires immediate attention.

Vulnerability could be exploited relatively easily and lead to significant impact. Requires prompt attention.

Exploitation is possible but might require specific conditions. Impact is moderate. Should be addressed in a timely manner.

Exploitation is difficult or impact is minimal. Address when convenient or as part of regular maintenance.

Severity is not determined, informational, or negligible. Review based on context.

About Sliplane

Sliplane is a simple container hosting solution. It enables you to deploy your containers in the cloud within minutes and scale up as you grow.

Try Sliplane for free

About the CVE Scanner

What is a CVE?

CVE stands for Common Vulnerabilities and Exposures. It is a standardized identifier for known security vulnerabilities, allowing developers and organizations to track and address potential risks effectively. For more information, visit cve.mitre.org.

About the CVE Scanner

The CVE Scanner is a powerful tool that helps you identify known vulnerabilities in your Docker images. By scanning your images against a comprehensive database of Common Vulnerabilities and Exposures (CVEs), you can ensure that your applications are secure and up-to-date. For more details, checkout the NIST CVE Database.

How the CVE Scanner Works

The CVE Scanner analyzes your Docker images against a comprehensive database of known vulnerabilities. It uses Docker Scout under the hood to provide detailed insights into affected packages, severity levels, and available fixes, empowering you to take immediate action.

Why CVE Scanning is Essential for Your Docker Images

With the rise of supply chain attacks, ensuring the security of your applications has become more critical than ever. CVE scanning plays a vital role in identifying vulnerabilities that could be exploited by attackers, especially those introduced through dependencies and third-party components. Regularly scanning and securing your Docker images is essential to protect your applications from these evolving threats.

Benefits of CVE Scanning

Enhanced Security: Detect and mitigate vulnerabilities before they are exploited.
Compliance: Meet industry standards and regulatory requirements for secure software.
Proactive Maintenance: Stay ahead of potential threats by addressing vulnerabilities early.

The Importance of Patching Docker Images

Patching your Docker images is a critical step in maintaining the security and stability of your applications. By regularly updating your images to include the latest security patches, you can address known vulnerabilities and reduce the risk of exploitation. This proactive approach ensures that your applications remain resilient against emerging threats and helps maintain compliance with security best practices.

Want to deploy this image?

Try out Sliplane - a simple Docker hosting solution. It provides you with the tools to deploy, manage and scale your containerized applications.