Executive brief
A security vulnerability has been identified in ASP.NET Core SignalR, a library used by developers to add real-time web functionality to applications. An attacker can exploit this flaw to cause a denial of service, making the application unavailable to legitimate users. This issue specifically affects applications that have the 'stateful reconnect' feature enabled.
Technical details
A denial of service vulnerability (CWE-770) exists in ASP.NET Core SignalR due to improper resource limits or throttling during stateful reconnect operations. The vulnerability is located within the Microsoft.AspNetCore.App.Runtime package across .NET 8, 9, and 10. An unauthenticated remote attacker can leverage the stateful reconnect mechanism to consume excessive resources, effectively denying service to other users. The attack vector is network-based and requires no user interaction or special privileges. Microsoft has released patched versions (8.0.26, 9.0.15, and 10.0.6) to address this issue.
Affected products
- Microsoft ASP.NET Core SignalR (Microsoft.AspNetCore.App.Runtime) >= 8.0.0, <= 8.0.25; >= 9.0.0, <= 9.0.14; >= 10.0.0, <= 10.0.5
Timeline
- 2026-07-14: disclosed: Advisory published
- 2026-07-21: advisory: GitHub Advisory updated
References
- https://github.com/dotnet/aspnetcore/security/advisories/GHSA-j8gr-8fp3-5q5h
- https://github.com/dotnet/announcements/issues/424
- https://github.com/dotnet/aspnetcore/discussions/67787
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170
- https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-j8gr-8fp3-5q5h