Key points
- CVE-2026-70159 allows unauthorized network attackers to deny service via resource exhaustion.
- Patches are available for .NET 8, 9, 10, and 11 SignalR packages.
- The flaw stems from unlimited resource allocation in stateful reconnect clients.
Microsoft has released security updates for ASP.NET Core SignalR packages to address a high-severity denial of service vulnerability, identified as CVE-2026-70159. The flaw affects applications running on Windows, Linux, and macOS that use specific versions of Microsoft.AspNetCore.SignalR.Common or Microsoft.AspNetCore.SignalR.Core. Patches are now available for .NET versions 8 through 11, including preview releases.
In plain English
The vulnerability allows an attacker to crash or block server broadcasts by exploiting how SignalR handles reconnecting clients. According to the GitHub advisory, stateful clients can indefinitely block broadcasts through backpressure mechanisms. This behavior causes the system to retain associated resources without limits or throttling. An unauthorized attacker can trigger this over a network, leading to a denial of service condition.
The background
Microsoft assigned a CVSS score of 7.5 to this issue, rating it as high severity. The weakness is classified as CWE-770, which covers the allocation of resources without limits. The vector string indicates that the attack requires no user interaction and no prior privileges. It affects all architectures supported by the affected .NET platforms.
What changes now
Developers must update their NuGet packages to the patched versions listed in the advisory. For .NET 8, the fix is in version 8.0.32. For .NET 9, version 9.0.21 is required. .NET 10 users need version 10.0.13, while .NET 11 preview users should move to 11.0.0-rc.2. Older .NET Core 1.x users must update to 1.2.14.
Who needs to act first
Teams usually prioritize systems exposed to the public internet for immediate patching. Check whether your application uses SignalR for real-time communication. If so, verify the current package versions against the affected ranges. Roll out fixes to a small subset of servers first to test for compatibility. Ensure you have recent backups before applying updates. Monitor system resources closely after deployment to confirm stability.
What to do and how to stay safe: Microsoft
- Audit your project dependencies to identify if you are using vulnerable SignalR package versions.
- Update to the patched versions listed in the Microsoft advisory as soon as possible.
- Monitor server logs for unusual resource consumption or broadcast failures during testing.
- Once the vendor provides an update, apply it to staging environments before production rollout.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-70159?
The CVSS 3.1 score is 7.5, which Microsoft rates as high severity.
Which .NET versions are affected by this flaw?
Versions 8, 9, 10, and 11 of the SignalR Common and Core packages are affected.
Does this vulnerability require authentication to exploit?
No, the advisory states that an unauthorized attacker can exploit this over a network.
