Update .NET 8-11 Now: SignalR Flaw CVE-2026-70159 Lets Attackers Crash Servers via Resource Exhaustion
Microsoft releases fixes for a resource exhaustion flaw in ASP.NET Core SignalR that allows remote attackers to deny service.
Key points
- Microsoft patches CVE-2026-70159, a high-severity denial of service vulnerability in ASP.NET Core.
- The flaw affects SignalR components in .NET versions 8 through 11 across Windows, Linux, and macOS.
- Attackers can exhaust server resources by exploiting stateful reconnection logic without authentication.
An attacker who exploits CVE-2026-70159 gains the ability to deny service to any application using vulnerable versions of Microsoft’s ASP.NET Core SignalR libraries. The threat actor needs only network access to the affected service, as the flaw requires no authentication or user interaction. By triggering specific connection behaviors, the attacker forces the server to allocate resources indefinitely, leading to a denial of service.
Microsoft released security updates to address this high-severity issue, which carries a CVSS score of 7.5. The vulnerability allows an unauthorized remote attacker to exhaust system resources through a lack of throttling in the SignalR Common and Core packages. This flaw impacts applications running on Windows, Linux, and macOS platforms, making it a cross-platform risk for businesses relying on real-time web functionality.
Context and background
This denial of service flaw stems from how SignalR handles stateful reconnect clients. When these clients attempt to reconnect, they can block broadcasts via the MessageBuffer.ResendAsync backpressure mechanism. This behavior causes the server to retain associated resources indefinitely. As Shell Bulletin reported on October 13, Microsoft previously addressed HTTP request smuggling in ASP.NET Core versions 8 through 11, highlighting ongoing risks in this framework.
Who is affected
Developers using specific versions of Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core are vulnerable. Affected versions include .NET 8.0.0 through 8.0.31, .NET 9.0.0 through 9.0.20, and .NET 10.0.0 through 10.0.12. The .NET Core package versions 1.0.0 through 1.2.13 are also at risk. Preview and release candidate versions of .NET 11, specifically 11.0.0-preview.5 through 11.0.0-rc.1, contain the flaw.
What to watch
Teams should immediately verify their dependency trees for the affected NuGet packages. Monitor application logs for unusual connection patterns or resource spikes that may indicate exploitation. Watch for further advisory updates from Microsoft regarding related vulnerabilities in the ASP.NET Core ecosystem. Ensure that deployment pipelines automatically pull the latest patched versions of SignalR components to prevent regression.
What made it possible
This incident illustrates a resource exhaustion weakness where systems fail to limit allocation during high-load or error states. Attackers leverage this to disrupt availability by forcing the target to consume memory or processing power beyond safe thresholds. In intrusion cycles, this technique serves as a denial-of-service vector, often used to degrade service quality or mask other activities. Teams usually mitigate such risks by implementing strict rate limiting and connection timeouts to prevent indefinite resource retention.
What to do and how to stay safe: Microsoft
- Audit your project dependencies to identify any instances of the vulnerable Microsoft.AspNetCore.SignalR packages listed in the advisory.
- Update your applications to the specific patched versions provided by Microsoft for your .NET framework version.
- Implement network-level rate limiting to restrict the number of concurrent connections from single sources to your SignalR endpoints.
- Monitor server resource utilization metrics for sudden spikes in memory or CPU usage that could signal an active exploitation attempt.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-70159?
The Common Vulnerability Scoring System version 3.1 rates this vulnerability as High with a score of 7.5.
Which .NET versions are affected by this SignalR flaw?
Versions 8, 9, 10, and specific preview versions of 11 are affected, as well as legacy .NET Core 1.2.x packages.
Is there a fix available for this vulnerability?
Yes, Microsoft has released patched versions of the affected SignalR packages for all vulnerable .NET versions.
