Key points
- Microsoft assigned CVE-2026-70159 a high severity score of 7.5 based on CVSS 3.1 metrics.
- The flaw allows unauthorized network attackers to deny service through resource allocation without limits.
- Patched versions are available for SignalR packages across .NET versions 8 through 11.
An unauthorized attacker can trigger a denial of service in ASP.NET Core applications by exploiting a resource allocation flaw in Microsoft.AspNetCore.SignalR packages. According to the Microsoft Security Update Guide, the vulnerability enables attackers to deny service over a network by causing the system to allocate resources without limits or throttling. This behavior allows the malicious code to block broadcasts indefinitely, retaining associated resources and impacting server availability for legitimate users. The issue stems from how stateful reconnect clients handle backpressure via `MessageBuffer.ResendAsync`, which retains resources under specific conditions.
By the numbers
- 7.5 is the CVSS 3.1 score assigned to CVE-2026-70159, classifying it as high severity.
- 10.0.13 is the patched version for Microsoft.AspNetCore.SignalR.Common in the .NET 10 series.
- 8.0.32 is the patched version for Microsoft.AspNetCore.SignalR.Common in the .NET 8 series.
What the figures mean
The high severity rating reflects the ease with which an attacker can exploit this flaw. The CVSS vector indicates network access with low complexity and no privileges required, meaning no authentication is needed to launch the attack. According to the GitHub advisory GHSA-334f-vvp4-7g6p, the vulnerability affects all architectures on Windows, Linux, and macOS platforms. The impact is strictly on availability, as the attacker can exhaust server resources to deny service but cannot compromise confidentiality or integrity. This makes the flaw a significant risk for applications relying on SignalR for real-time communication features.
What to watch
Security teams should monitor their application logs for unusual spikes in resource consumption or blocked broadcast messages. According to the advisory, the flaw specifically impacts stateful reconnect clients that use `MessageBuffer.ResendAsync`. Analysts should look for patterns where clients reconnect repeatedly and hold onto resources, preventing other users from receiving data. This behavior is associated with the denial of service condition described in the advisory. Teams using older versions of SignalR should prioritize scanning their NuGet package dependencies to identify if they are running vulnerable versions listed in the official guidance.
Infection and persistence in general
Teams usually encounter resource exhaustion flaws through automated scanning tools or targeted attacks against public endpoints. Analysts examine network traffic for abnormal connection rates and monitor server metrics for sudden drops in available memory or CPU capacity. Persistence is not typical for this class of vulnerability, as the goal is immediate disruption rather than long-term access. Investigators check application logs for repeated connection attempts from single sources and review configuration settings for missing rate limits. They also verify that backpressure mechanisms are functioning correctly to prevent indefinite resource retention during high-load scenarios.
What to do and how to stay safe: Microsoft
- Audit your NuGet package dependencies to identify any installations of Microsoft.AspNetCore.SignalR.Common or Microsoft.AspNetCore.SignalR.Core within the affected version ranges.
- Update vulnerable packages to the patched versions listed in the advisory, such as 8.0.32 for .NET 8 or 10.0.13 for .NET 10, to resolve the resource allocation issue.
- Implement network-level rate limiting and connection throttling for SignalR endpoints to mitigate the impact of potential resource exhaustion attacks until patches are applied.
- Monitor server resource utilization and application logs for signs of abnormal behavior, such as blocked broadcasts or indefinite resource retention, to detect ongoing exploitation attempts.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific packages are affected by CVE-2026-70159?
The vulnerability affects Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core packages across multiple .NET versions.
Is authentication required to exploit this vulnerability?
No, the CVSS vector indicates that no privileges are required, allowing unauthorized network attackers to exploit the flaw.
What platforms are vulnerable to this denial of service flaw?
According to the advisory, the vulnerability affects applications running on Windows, Linux, and macOS across all architectures.
