Potential Denial of Service Vulnerability in .NET ASP.NET Core SignalR
An early warning has been issued regarding a potential denial of service vulnerability in ASP.NET Core SignalR within.NET 8,.NET 9, and.NET 10. This vulnerability, reportedly affecting specific Linux runtime components, is under investigation.
What happened
An early warning has been issued for a potential denial of service vulnerability tracked as CVE-2026-56170 and GHSA-J8GR-8FP3-5Q5H. This vulnerability reportedly exists in ASP.NET Core SignalR within.NET 8,.NET 9, and.NET 10. The issue appears to allow an attacker to leverage stateful reconnect to deny service to other users.
Affected components include specific Linux runtime NuGet packages: Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm, and Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, all within versions >=10.0.0 and <=10.0.5.
It is recommended to upgrade to the patched version 10.0.6 for affected packages. Further details and confirmation should be obtained from the primary sources, specifically the Microsoft Security Advisory CVE-2026-56170 –.NET Denial of Service Vulnerability.
How 0Day mitigates this
Microsoft.AspNetCore.App.Runtime.linux-arm is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.