high · 7.5CVE-2026-56170Jul 21, 2026

CVE-2026-56170: ASP.NET Core SignalR Stateful Reconnect Denial of Service

Rohit Hatagale
AI Security Researcher, SecureLayer7

An unauthenticated attacker can exhaust server memory by opening a SignalR connection with stateful reconnect enabled and deliberately withholding ACKs, forcing the server to buffer messages without…

PackageMicrosoft.AspNetCore.App.Runtime.linux-arm
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.5
Fixed in10.0.6

The problem

ASP.NET Core SignalR's stateful reconnect feature buffers outbound messages server-side, waiting for the client to ACK each one before discarding them from the buffer.

When a client connects with stateful reconnect negotiated but never sends ACKs, the server accumulates those buffered messages indefinitely. There is no enforced upper bound on how many pending messages a single connection can force the server to retain, so an attacker with one or more connections can exhaust process memory and deny service to legitimate users.

Only applications that explicitly opt in to stateful reconnect (AllowStatefulReconnects on the hub endpoint) are affected.

The fix

Upgrade to .NET 10.0.6, .NET 9.0.15, or .NET 8.0.26. All Microsoft.AspNetCore.App.Runtime packages on those release lines are patched. If upgrading immediately is not possible, disable stateful reconnect on all hub endpoints (remove WithStatefulReconnect() / AllowStatefulReconnects = false) as a temporary mitigation.

Reported by Ky0toFu.

References: [1][2][3][4][5][6]

Related research