Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisCVE-2026-70159 is a denial-of-service vulnerability in Microsoft.AspNetCore.SignalR.Common (CWE-770, allocation of resources without limits or throttling). The advisory and announcement both state the root cause precisely: "SignalR stateful reconnect clients can indefinitely block broadcasts through MessageBuffer.ResendAsync backpressure and retain associated resources." The vulnerable component is the internal MessageBuffer class (namespace Microsoft.AspNetCore.SignalR.Internal) in src/SignalR/common/Shared/MessageBuffer.cs. The ResendAsync method re-sends buffered messages to a reconnecting client by awaiting PipeWriter.WriteAsync while holding the write lock; a client that does not read from its transport causes the write to block indefinitely on backpressure, blocking broadcasts and retaining buffered messages/resources. WriteAsyncCore is the companion write path that buffers messages and awaits the resend task, so it is also blocked during exploitation. These are the functions that would appear in a runtime profile/stack trace when the vulnerability is triggered.
Microsoft.AspNetCore.SignalR.Internal.MessageBuffer.ResendAsyncsrc/SignalR/common/Shared/MessageBuffer.cs
Microsoft.AspNetCore.SignalR.Internal.MessageBuffer.WriteAsyncCoresrc/SignalR/common/Shared/MessageBuffer.cs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.AspNetCore.SignalR.Common | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.SignalR.Common | nuget | >= 11.0.0-preview.5, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.SignalR.Common | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.SignalR.Common | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |