Executive brief
A security vulnerability has been identified in Microsoft ASP.NET Core components used for real-time web communication (SignalR and Blazor Server). An attacker can exploit this flaw to crash the web application, leading to a service outage. This affects businesses using these frameworks to provide interactive, real-time features to their users.
Technical details
A denial of service vulnerability (CWE-400) exists in the MessagePack hub protocol implementation within ASP.NET Core SignalR and Blazor Server. The root cause is insufficient validation of nested structures, allowing a remote, unauthenticated attacker to send specially crafted, deeply-nested MessagePack arrays. This triggers a stack overflow during deserialization, resulting in an immediate crash of the application process. The vulnerability affects .NET 8, 9, and 10 environments. Patches are available in versions 8.0.28, 9.0.17, and 10.0.9.
Affected products
- Microsoft ASP.NET Core 8.0.0 - 8.0.27, 9.0.0 - 9.0.16, 10.0.0 - 10.0.8
- Microsoft Microsoft.AspNetCore.SignalR.Protocols.MessagePack 8.0.0 - 8.0.27, 9.0.0 - 9.0.16, 10.0.0 - 10.0.8
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-06-15: patched: Advisory updated with final patch details
References
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-f8h2-vmm9-qhj6
- https://github.com/dotnet/announcements/issues/405
- https://github.com/dotnet/aspnetcore/discussions/67100
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591
- https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-f8h2-vmm9-qhj6