# Microsoft ASP.NET Core SignalR memory leak denial of service

Source: https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-asp-net-core-denial-of-f6859a00  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-11-10

ASP.NET Core's SignalR library, which handles real-time communication in web applications, has a memory leak that allows attackers to exhaust server memory and cause service outages. An attacker can trigger the leak remotely without authentication, impacting application availability.

Technologies: [Microsoft.AspNetCore.SignalR.StackExchangeRedis (NuGet)](https://junglewise.ai/threats/technologies/microsoft-aspnetcore-signalr-stackexchangeredis). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Microsoft ASP.NET Core SignalR StackExchangeRedis 8.0.0-preview.1.23112.2 through 8.0.33; Microsoft.AspNetCore.SignalR.StackExchangeRedis (NuGet) >= 8.0.0-preview.1.23112.2, <= 8.0.33, ECOSYSTEM:introduced=8.0.0-preview.1.23112.2,last_affected=8.0.33.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Microsoft ASP.NET Core SignalR StackExchangeRedis or Microsoft.AspNetCore.SignalR.StackExchangeRedis (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory leak in Microsoft.AspNetCore.SignalR.StackExchangeRedis allows memory to be allocated but not released after use, enabling a denial-of-service attack. The vulnerability is reachable over the network without authentication or user interaction. An attacker can exhaust memory resources, causing the affected application to become unavailable.

## Affected products

- Microsoft ASP.NET Core SignalR StackExchangeRedis 8.0.0-preview.1.23112.2 through 8.0.33

## Timeline

- 2026-11-10: disclosed

## Related threats

- [Microsoft ASP.NET Core memory leak denial of service](https://junglewise.ai/threats/cve-2026-114147-missing-release-of-memory-after-effective-lifetime-in-asp-net)
- [.NET Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2023-35391-net-information-disclosure-vulnerability)