Is CVE-2026-56170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56170 being exploited in the wild.

How severe is CVE-2026-56170?

High severity, with a CVSS score of 7.5, published 14 July 2026.

How is CVE-2026-56170 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56170?

Check whether you run Microsoft ASP.NET Core SignalR, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56170: Microsoft ASP.NET Core denial of service via resource exhaustion

Q: Is there a fix for CVE-2026-56170?

Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-56170 · Severity: high · CVSS 7.5 · Published 2026-07-14

A security vulnerability has been identified in ASP.NET Core SignalR, a library used by developers to add real-time web functionality to applications. An attacker can exploit this flaw to cause a denial of service, making the application unavailable to legitimate users. This issue specifically affects applications that have the 'stateful reconnect' feature enabled.

Quick answers

Is CVE-2026-56170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56170 being exploited in the wild.
How severe is CVE-2026-56170?: High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?: Microsoft ASP.NET Core SignalR >= 8.0.0, <= 8.0.25; >= 9.0.0, <= 9.0.14; >= 10.0.0, <= 10.0.5; Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; and 9 more.
Is there a fix for CVE-2026-56170?: Yes. Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56170 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56170?: Check whether you run Microsoft ASP.NET Core SignalR, Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet), Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 10.0.6

Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 10.0.6

Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm --version 10.0.6

Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 10.0.6

Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 10.0.6

Technical details

A denial of service vulnerability (CWE-770) exists in ASP.NET Core SignalR due to improper resource limits or throttling during stateful reconnect operations. The vulnerability is located within the Microsoft.AspNetCore.App.Runtime package across .NET 8, 9, and 10. An unauthenticated remote attacker can leverage the stateful reconnect mechanism to consume excessive resources, effectively denying service to other users. The attack vector is network-based and requires no user interaction or special privileges. Microsoft has released patched versions (8.0.26, 9.0.15, and 10.0.6) to address this issue.

Affected products

Microsoft ASP.NET Core SignalR (Microsoft.AspNetCore.App.Runtime) >= 8.0.0, <= 8.0.25; >= 9.0.0, <= 9.0.14; >= 10.0.0, <= 10.0.5

Identifiers

CVE-2026-56170
GHSA-j8gr-8fp3-5q5h

Timeline

2026-07-14: disclosed: Advisory published
2026-07-21: advisory: GitHub Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.