NUGET · JULY 2026 · EARLY WARNING

Potential Denial of Service Vulnerability in .NET ASP.NET Core SignalR

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
CVE-2026-56170GHSA-J8GR-8FP3-5Q5HSeverity: HIGH

An early warning has been issued regarding a potential denial of service vulnerability in ASP.NET Core SignalR within.NET 8,.NET 9, and.NET 10. This vulnerability, reportedly affecting specific Linux runtime components, is under investigation.

What happened

An early warning has been issued for a potential denial of service vulnerability tracked as CVE-2026-56170 and GHSA-J8GR-8FP3-5Q5H. This vulnerability reportedly exists in ASP.NET Core SignalR within.NET 8,.NET 9, and.NET 10. The issue appears to allow an attacker to leverage stateful reconnect to deny service to other users.

Affected components include specific Linux runtime NuGet packages: Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm, and Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, all within versions >=10.0.0 and <=10.0.5.

It is recommended to upgrade to the patched version 10.0.6 for affected packages. Further details and confirmation should be obtained from the primary sources, specifically the Microsoft Security Advisory CVE-2026-56170 –.NET Denial of Service Vulnerability.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If Microsoft.AspNetCore.App.Runtime.linux-arm is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats