ASP.NET Core SignalR: Denial of Service in stateful reconnect handling

Summary

A resource allocation flaw in the SignalR libraries of ASP.NET Core allows an unauthenticated remote attacker to deny service. Clients that reconnect in a specific stateful state can indefinitely block broadcasts and keep server resources allocated. The attack requires no login and no user interaction, so an exposed SignalR endpoint of a public web application can be targeted directly. Impact is limited to availability; no data theft or code execution is indicated.

Affected

• Microsoft.AspNetCore.SignalR.Common 8.0.0 to before 8.0.32
• Microsoft.AspNetCore.SignalR.Common 9.0.0 to before 9.0.21
• Microsoft.AspNetCore.SignalR.Common 10.0.0 to before 10.0.13
• Microsoft.AspNetCore.SignalR.Common 11.0.0-preview.5 to before 11.0.0-rc.2 (per GitLab advisory database, not listed in the CNA data)
• Microsoft.AspNetCore.SignalR.Core 1.0.0 to before 1.2.14 (per CNA data)
• Visual Studio 2022 version 17.14.0 to before 17.14.42
• Visual Studio 2026 version 18.10.0 to before 18.10.4

Fixed in

• Microsoft.AspNetCore.SignalR.Common 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2
• Microsoft.AspNetCore.SignalR.Core 1.2.14 (version reported by third-party databases; not confirmed on the Microsoft advisory page, verify in MSRC)
• Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4
• Microsoft patch option: .NET 8 Runtime 8.0.32 or SDK 8.0.426; .NET 10 Runtime 10.0.13 or SDK 10.0.402; .NET 11 Runtime 11.0.0-rc.2 or SDK 11.0.100-rc.2. Restart applications afterwards.

Workaround

• No vendor workaround known. Microsoft recommends applying the patch.
• Interim measure (own analysis, not vendor guidance, effectiveness not verified): limit exposure of SignalR endpoints via a reverse proxy or WAF with connection and rate limits, and monitor for resource exhaustion.

Exploitation

• Microsoft rates exploitation as 'Less Likely' and the flaw as not publicly disclosed.
• Tenable: no known exploits are available.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS: 0.0123.
• No public proof of concept or evidence of exploitation in the wild was found in the reviewed sources.

Our recommendation

• Identify internet-facing ASP.NET Core applications that use SignalR and prioritize them.
• Update the SignalR packages or the .NET Runtime/SDK to the fixed versions and restart the applications.
• Update Visual Studio 2022 and 2026 on developer workstations.
• Verify the SignalR.Core fixed version against the MSRC entry.
• Until patched, limit connections and request rates to SignalR endpoints and monitor for resource exhaustion.
• Patch in the next regular maintenance window, or sooner for public-facing apps with real-time features.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide msrc.microsoft.com
• GitHub ASP.NET Core advisory discussion github.com
• GitLab advisory database (version ranges) advisories.gitlab.com
• CNA data (Visual Studio versions) vulners.com
• Vulners MSCVE entry vulners.com
• Tenable plugin 366548 www.tenable.com
• Red Hat bug 2548786 bugzilla.redhat.com
• Miggo (third-party) www.miggo.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:04.