CVE-2026-26130: 
C# vulnerability analysis and mitigation

CVE-2026-26130 is a Denial of Service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling. A specially crafted message sent to a SignalR server can exhaust an internal buffer, causing the application to become unavailable. Affected versions include ASP.NET Core 8.0.0–8.0.24, 9.0.0–9.0.13, and 10.0.0–10.0.3, across all platforms and architectures. The vulnerability was disclosed on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Specifically, the vulnerability exists in ASP.NET Core's SignalR server component, where a specially crafted network message can cause an internal buffer to be exhausted without any imposed size or count restrictions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity — making it trivially exploitable by any remote attacker who can reach a SignalR endpoint. No public proof-of-concept code has been identified at this time (GitHub Advisory, Microsoft MSRC).

Successful exploitation results in a Denial of Service condition, rendering the affected ASP.NET Core application unavailable to legitimate users. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Applications hosting SignalR endpoints are at highest risk, and sustained exploitation could cause prolonged outages without any attacker foothold on the underlying system (GitHub Advisory, Microsoft MSRC).

1. Reconnaissance: Identify internet-facing ASP.NET Core applications running vulnerable versions (8.0.0–8.0.24, 9.0.0–9.0.13, or 10.0.0–10.0.3) that expose SignalR endpoints, using tools like Shodan, Censys, or manual probing of /signalr or hub-specific URLs.
2. Connect to SignalR endpoint: Establish a WebSocket or long-polling connection to the target's SignalR hub endpoint (e.g., wss://target/hub).
3. Send crafted messages: Transmit specially crafted SignalR protocol messages designed to trigger unbounded internal buffer allocation without triggering normal message processing limits.
4. Exhaust server resources: Repeat or sustain the crafted message stream to continuously grow the internal buffer, eventually exhausting available memory or processing capacity.
5. Achieve DoS: The server becomes unresponsive to legitimate clients as the internal buffer is fully exhausted, resulting in a denial of service condition (GitHub Advisory).

• Network: Unusual volume of WebSocket or long-polling connections to SignalR hub endpoints from a single or small set of source IPs; abnormally large or malformed SignalR protocol messages in network captures.
• Logs: ASP.NET Core application logs showing repeated connection attempts or message processing errors from SignalR hubs; out-of-memory exceptions or buffer overflow errors in application event logs.
• Process/System: Rapid increase in memory consumption by the ASP.NET Core worker process (dotnet.exe or dotnet on Linux) without a corresponding increase in legitimate user traffic; application pool recycling or process crashes correlated with inbound SignalR traffic spikes.
• Application: Degraded response times or complete unavailability of the application coinciding with elevated SignalR connection counts.

Microsoft released patched versions on March 10, 2026: update to ASP.NET Core 8.0.25, 9.0.14, or 10.0.4 as appropriate. Self-contained applications targeting affected versions must be recompiled and redeployed after updating the SDK. As interim controls, implement network-level rate limiting and connection throttling in front of SignalR endpoints (e.g., via reverse proxy or WAF rules), and monitor for unusual resource consumption patterns. Visual Studio users will be prompted to update, which will also update the .NET SDK (GitHub Advisory, Microsoft MSRC, .NET Blog).

The vulnerability was covered as part of broader March 2026 Patch Tuesday reporting by outlets including BleepingComputer, CyberSecurityNews, Rapid7, and Zero Day Initiative, which noted it among 79 vulnerabilities addressed that month. Sophos and Lansweeper also published Patch Tuesday summaries referencing this CVE. Red Hat, Ubuntu, AlmaLinux, and Rocky Linux all issued corresponding advisories and errata for their .NET packages. The security community noted the vulnerability was credited to researcher Bartłomiej Dach (GitHub Advisory, .NET Blog).