Microsoft ASP.NET Core SignalR MessagePack denial of service

Severity: medium · CVSS 5.3 · Published 2026-10-13

ASP.NET Core's SignalR service uses MessagePack to deserialize real-time communication messages. An attacker can send specially crafted messages with deeply nested arrays that cause the server to consume excessive memory, crashing the application and disrupting service for all users.

Technologies: Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 5.3, published 13 October 2026.
Which products and versions are affected?
Microsoft ASP.NET Core SignalR Protocols MessagePack 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.5 to 11.0.0-rc.1; Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.
Is there a fix for This vulnerability?
Yes. Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet): upgrade to 10.0.13 or later. Until then: Update the Microsoft.AspNetCore.SignalR.Protocols.MessagePack package to the patched version listed for your affected version. Self-contained applications targeting vulnerable versions must be recompiled and redeployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Microsoft ASP.NET Core SignalR Protocols MessagePack or Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet): upgrade to 10.0.13 or later
    dotnet add package Microsoft.AspNetCore.SignalR.Protocols.MessagePack --version 10.0.13

Update the Microsoft.AspNetCore.SignalR.Protocols.MessagePack package to the patched version listed for your affected version. Self-contained applications targeting vulnerable versions must be recompiled and redeployed.

Technical details

The vulnerability exists in Microsoft.AspNetCore.SignalR.Protocols.MessagePack during deserialization of attacker-controlled MessagePack data. By sending messages with deeply nested arrays, an attacker can trigger uncontrolled memory allocation (CWE-1325), exhausting server resources without authentication. This is a network-based denial of service affecting affected versions of the package.

Affected products

  • Microsoft ASP.NET Core SignalR Protocols MessagePack 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.5 to 11.0.0-rc.1

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.