7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-56170

CVE-2026-56170: ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-56170

CVE-2026-56170:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Microsoft.AspNetCore.App.Runtime.linux-arm	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.linux-arm64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.linux-x64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.osx-arm64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.osx-x64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.win-arm	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.win-arm64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.win-x64	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.win-x86	nuget	>= 10.0.0, <= 10.0.5	10.0.6
Microsoft.AspNetCore.App.Runtime.linux-arm	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.linux-arm64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.linux-x64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.osx-arm64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.osx-x64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.win-arm	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.win-arm64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.win-x64	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.win-x86	nuget	>= 9.0.0, <= 9.0.14	9.0.15
Microsoft.AspNetCore.App.Runtime.linux-arm	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.linux-arm64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.linux-musl-arm	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.linux-musl-x64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.linux-x64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.osx-arm64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.osx-x64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.win-arm	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.win-arm64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.win-x64	nuget	>= 8.0.0, <= 8.0.25	8.0.26
Microsoft.AspNetCore.App.Runtime.win-x86	nuget	>= 8.0.0, <= 8.0.25	8.0.26

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in ASP.NET Core SignalR's stateful reconnect feature. The root cause is in the MessageBuffer.WriteAsyncCore method, which could block indefinitely when backpressure was applied by a client, leading to resource exhaustion on the server. The analysis of the commits between the vulnerable and patched versions revealed the exact code changes that introduced a timeout to mitigate this issue. The primary vulnerable function is Microsoft.AspNetCore.SignalR.Shared.MessageBuffer.WriteAsyncCore, where the unbounded wait occurred. The function Microsoft.AspNetCore.SignalR.HubConnectionContext.WriteCore is also identified as a key part of the vulnerable code path, as it's the server-side function that invokes the vulnerable message buffering logic when stateful reconnect is in use.

Vulnerable functions

Microsoft.AspNetCore.SignalR.Shared.MessageBuffer.WriteAsyncCore

src/SignalR/common/Shared/MessageBuffer.cs

The vulnerability lies in the `WriteAsyncCore` method within the `MessageBuffer` class. When the message buffer is full, the method enters a loop, waiting for an acknowledgment (_waitForAck) from the client before proceeding. Prior to the patch, this wait was not time-bound. A malicious client could intentionally withhold the acknowledgment, causing the server to wait indefinitely. This would tie up server resources, leading to a denial-of-service condition as other clients would be blocked from sending messages.

Microsoft.AspNetCore.SignalR.HubConnectionContext.WriteCore

src/SignalR/server/Core/src/HubConnectionContext.cs

This function is the entry point on the server for writing messages to a client connection. When stateful reconnect is enabled, it calls the vulnerable `MessageBuffer.WriteAsync` method. The patch wraps this call in a helper function that provides a timeout, especially for `CloseMessage`, to prevent the connection from being blocked indefinitely by a malicious client.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-56170: ASP.NET Core Denial of Service Vulnerability

CVE-2026-56170:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

7.5

7.5

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

CVE-2026-56170: ASP.NET Core Denial of Service Vulnerability

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-56170: ASP.NET Core Denial of Service Vulnerability

CVE-2026-56170:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

7.5

7.5

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

CVE-2026-56170: ASP.NET Core Denial of Service Vulnerability

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI