CVE-2026-56170: 
C# vulnerability analysis and mitigation

CVE-2026-56170 is a Denial of Service vulnerability in ASP.NET Core SignalR affecting Microsoft .NET 8.0, 9.0, and 10.0. The flaw stems from allocation of resources without limits or throttling (CWE-770), allowing an unauthenticated network attacker to exhaust server resources and render affected applications unavailable. It was disclosed on July 14, 2026, as part of Microsoft's July 2026 Patch Tuesday, which addressed a record 570 vulnerabilities. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Microsoft MSRC, Github Advisory).

The vulnerability is rooted in ASP.NET Core SignalR's stateful reconnect feature, which fails to impose adequate limits on resource allocation (CWE-770). An attacker can abuse the stateful reconnect mechanism to trigger unbounded resource consumption on the server without requiring authentication or user interaction. The attack is network-based, low-complexity, and fully automatable, making it straightforward to exploit at scale. Applications are only affected if they use SignalR with the stateful reconnect feature explicitly enabled (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service, causing the ASP.NET Core application to become unavailable to legitimate users by exhausting server-side resources. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Applications relying on SignalR for real-time communication (e.g., chat, live dashboards, collaborative tools) are at heightened operational risk if the stateful reconnect feature is enabled (Github Advisory, Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.80% (52nd percentile), indicating a relatively low near-term exploitation probability. The attack is automatable and requires no privileges or user interaction, which increases the theoretical risk if a PoC becomes available (Github Advisory).

1. Reconnaissance: Identify internet-facing ASP.NET Core applications running .NET 8.0 (≤8.0.25), .NET 9.0 (≤9.0.14), or .NET 10.0 (≤10.0.5) that use SignalR with stateful reconnect enabled. Tools like Shodan or Censys can help identify exposed endpoints.
2. Establish initial SignalR connection: Connect to the target's SignalR hub endpoint (typically /hub or a custom path) using a standard SignalR client or raw WebSocket/HTTP connection.
3. Abuse stateful reconnect: Repeatedly initiate reconnect sequences without properly completing or releasing them, exploiting the lack of resource throttling to accumulate server-side state and memory allocations.
4. Exhaust server resources: Sustain a high volume of concurrent reconnect attempts to drive CPU, memory, or connection pool exhaustion, causing the application to become unresponsive or crash for legitimate users (Github Advisory).

• Network: Unusually high volume of SignalR connection/reconnect requests from one or more source IPs; sustained WebSocket or long-polling traffic to SignalR hub endpoints without normal application activity patterns.
• Logs: ASP.NET Core application logs showing repeated reconnect attempts, connection state errors, or resource allocation warnings; IIS/Kestrel logs with spikes in connection counts or request timeouts.
• Process/System: Elevated memory or CPU consumption by the .NET application process (e.g., dotnet.exe or the application host process) without a corresponding increase in legitimate user activity; out-of-memory exceptions or application pool recycling events.
• Application: Increased rate of HTTP 503 (Service Unavailable) responses from the affected application; SignalR hub becoming unresponsive to legitimate clients.

Microsoft has released patched versions addressing this vulnerability: .NET 8.0.26, .NET 9.0.15, and .NET 10.0.6 (NuGet packages updated accordingly). Applications that do not use ASP.NET Core SignalR with stateful reconnect enabled are not affected and require no action. As a workaround, disabling the stateful reconnect feature in SignalR eliminates the attack surface. Additionally, implementing rate limiting and request throttling at the application or infrastructure layer (e.g., reverse proxy, WAF) can reduce exposure. Red Hat has issued corresponding errata (RHSA-2026:41893 through RHSA-2026:41901) for RHEL 8, 9, and 10 (Github Advisory, Red Hat Bugzilla, Microsoft MSRC).

The vulnerability was covered as part of broader reporting on Microsoft's July 2026 Patch Tuesday, which was notable for addressing a record 570 vulnerabilities including three zero-days. Security outlets such as BleepingComputer, CyberSecurityNews, GBHackers, and Rapid7 covered the Patch Tuesday release, though CVE-2026-56170 itself received limited individual attention given its moderate severity and lack of active exploitation. The .NET team published an announcement on GitHub (dotnet/announcements#424) providing developer-focused guidance (Github Advisory).