ASP.NET Core: Denial of service via missing memory release
Summary
ASP.NET Core contains a flaw classified as missing release of memory after effective lifetime (CWE-401). According to Microsoft's advisory, SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification. A remote, unauthenticated attacker can exhaust server resources and cause a denial of service, while confidentiality and integrity are not affected. The CVSS 3.1 base score is 7.5 (High).
Affected
- Microsoft.AspNetCore.SignalR.StackExchangeRedis: 8.0.0-preview.1.23112.2 to 8.0.33, 9.0.0-preview.1.24081.5 to 9.0.22, 10.0.0-preview.1.25120.3 to 10.0.14, 11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
- Microsoft .NET 8.0, 9.0, 10.0 and 11.0 runtime on Linux, Mac OS and Windows (official CVE record: 8.0.0 to before 8.0.34, 9.0.0 to before 9.0.23, 10.0.0 to before 10.0.15, 11.0.0-preview.1 to before 11.0.0)
- Visual Studio 2022 17.14 and Visual Studio 2026 18.11 (unverified; the 18.12 range in the CVE record is internally inconsistent)
Fixed in
- Microsoft.AspNetCore.SignalR.StackExchangeRedis: 8.0.34, 9.0.23, 10.0.15, 11.0.0
- .NET runtime: 8.0.34, 9.0.23, 10.0.15, 11.0.0 (verify on the MSRC page)
Workaround
Unknown. No official workaround has been published. Upgrading to the fixed versions is the practical mitigation.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV at the time of research.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory .NET 8 to 11 applications and NuGet dependencies for Microsoft.AspNetCore.SignalR.StackExchangeRedis, including transitive references.
- Update the ASP.NET Core runtime and the StackExchangeRedis package to the fixed versions and redeploy.
- Prioritise internet-facing SignalR applications that use Redis scale-out.
- Verify the runtime and Visual Studio ranges on the MSRC page and re-check NVD once analysis is complete.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-114147 msrc.microsoft.com
- Microsoft .NET announcement issue 509 (advisory summary) github.com
- .NET and .NET Framework November 2026 servicing updates devblogs.microsoft.com
- Strix: CVE-2026-114147 www.strix.ai
- Senserva knowledge base: CVE-2026-114147 senserva.com
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- Socket: microsoft.aspnetcore.signalr.stackexchangeredis socket.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:51.
Original description (NVD)
Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.