CVE-2026-70159: 
C# vulnerability analysis and mitigation

CVE-2026-70159 is a Denial of Service vulnerability in ASP.NET Core caused by allocation of resources without limits or throttling (CWE-770). It specifically affects the SignalR components Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core, where stateful reconnect clients can indefinitely block broadcasts through MessageBuffer.ResendAsync backpressure and retain associated resources. Affected products include Microsoft.AspNetCore.SignalR.Common (versions 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.5–11.0.0-rc.1), Microsoft.AspNetCore.SignalR.Core (versions 1.0.0–1.2.13), Microsoft Visual Studio 2022 version 17.14 (before 17.14.42), and Microsoft Visual Studio 2026 version 18.10 (before 18.10.4). The vulnerability was disclosed on October 13, 2026, as part of Microsoft's October 2026 Patch Tuesday. It carries a CVSS v3.1 base score of 7.5 (High) (Microsoft MSRC, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In ASP.NET Core's SignalR implementation, stateful reconnect clients can exploit the MessageBuffer.ResendAsync backpressure mechanism to indefinitely block broadcast operations and hold onto associated server-side resources without releasing them. This allows an unauthenticated remote attacker to exhaust server resources by establishing connections and leveraging the reconnect flow, requiring no privileges or user interaction. The vulnerability affects all platforms (Windows, Linux, macOS) and all architectures where the affected NuGet packages are in use (GitHub Advisory, Microsoft MSRC).

Successful exploitation results in a denial of service condition, rendering the affected ASP.NET Core application unavailable to legitimate users. An unauthenticated network attacker can exhaust server resources — such as memory and connection handles — causing the application to crash or become unresponsive. There is no impact on confidentiality or data integrity; the sole impact is high availability loss. Self-contained applications targeting affected versions are also vulnerable and must be recompiled and redeployed (GitHub Advisory, Microsoft MSRC).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The attack is network-based, requires no authentication, no privileges, and no user interaction, making it automatable — a characteristic noted in the NVD SSVC assessment. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (Microsoft MSRC).

1. Reconnaissance: Identify internet-facing ASP.NET Core applications using SignalR with stateful reconnect enabled, targeting services running affected versions of Microsoft.AspNetCore.SignalR.Common or Microsoft.AspNetCore.SignalR.Core.
2. Establish SignalR connection: Connect to the target SignalR hub endpoint (e.g., /hub) using a WebSocket or long-polling transport, initiating a stateful reconnect-capable session.
3. Trigger stateful reconnect: Simulate a disconnect and reconnect cycle to engage the MessageBuffer.ResendAsync backpressure mechanism on the server.
4. Block broadcast and retain resources: Deliberately stall or slow the client-side consumption of messages, causing the server's MessageBuffer.ResendAsync to block indefinitely while holding server-side resources (memory, connection state).
5. Scale the attack: Repeat steps 2–4 with many concurrent connections to exhaust server resources (memory, threads, connection handles), causing the application to become unresponsive or crash, denying service to legitimate users (GitHub Advisory).

• Network: High volume of WebSocket or long-polling connections to SignalR hub endpoints from one or multiple source IPs; connections that remain open without normal message throughput.
• Application Logs: Repeated or sustained MessageBuffer.ResendAsync operations in ASP.NET Core logs; warnings or errors related to backpressure or resource exhaustion in SignalR hub logs.
• Process/System: Abnormal memory growth in the ASP.NET Core worker process (dotnet.exe or equivalent); high thread count or connection handle exhaustion; application pool recycling or process crashes correlated with unusual connection patterns.
• Infrastructure: Alerts from load balancers or reverse proxies indicating backend health check failures or connection timeouts to the ASP.NET Core application (GitHub Advisory).

Microsoft has released patched versions for all affected packages and tools: update Microsoft.AspNetCore.SignalR.Common to 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2; update Microsoft.AspNetCore.SignalR.Core to 1.2.14; update Visual Studio 2022 version 17.14 to 17.14.42 or later; and update Visual Studio 2026 version 18.10 to 18.10.4 or later. Developers should update NuGet package references in their projects and restart applications after updating. Self-contained applications must be recompiled and redeployed against the patched SDK. As a defense-in-depth measure, implement rate limiting and connection throttling at the application and infrastructure level to limit the impact of resource exhaustion attacks (GitHub Advisory, Microsoft MSRC).

The vulnerability was covered as part of Microsoft's October 2026 Patch Tuesday, which addressed a large number of flaws. Zero Day Initiative published a review of the October 2026 security updates, and BleepingComputer reported on the broader Patch Tuesday release (ZDI Blog, BleepingComputer). The vulnerability was acknowledged with credit to researcher nono Vincent55 Yang (GitHub Advisory). No significant independent researcher commentary or notable social media discussion specific to this CVE has been identified beyond standard Patch Tuesday coverage.