Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

• microsoft.aspnetcore.signalr.common · nuget.org
• microsoft.aspnetcore.signalr.core · nuget.org

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · GitLab Advisory Database

   Detected

   Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignalR stateful reconnect clients can indefinitely block broadcasts through MessageBuffer.ResendAsync backpr

Affected

• nuget microsoft.aspnetcore.signalr.commonversion unspecified
• nuget microsoft.aspnetcore.signalr.coreversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-70159

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-70159

  30-day exploitation probability 1.1%

  first.org
• GitLab Advisory DatabasePackage advisoryCVE-2026-70159

  Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignalR stateful reconnect clients can indefinitely block broadcasts through MessageBuffer.ResendAsync backpr

  advisories.gitlab.com