High, CVSS 7.5NuGetAmendedPublished
Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability
CVE-2026-70159 · GHSA-334f-vvp4-7g6p
- Affected
- NuGet microsoft.aspnetcore.signalr.common >= 10.0.0, <= 10.0.12; >= 11.0.0-preview.5, <= 11.0.0-rc.1; >= 8.0.0, <= 8.0.31; >= 9.0.0, <= 9.0.20
- Fixed in
- 11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
- Issue
- Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignalR stateful reconnect clients can indefinitely block broadcasts through MessageBuffer.ResendAsync backpressure and retain associated resources. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/452 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.