Patch Forecast
Amber warning
Patch this week.

CVE-2026-70159 ยท GHSA-334f-vvp4-7g6p

Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Risk score
74/100
CVSS
7.5 v3.1
Exploit chance (30 days)
1.2%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Affected
Microsoft.AspNetCore.SignalR.Common (nuget) >= 10.0.0, <= 10.0.12; Microsoft.AspNetCore.SignalR.Common (nuget) >= 11.0.0-preview.5, <= 11.0.0-rc.1; Microsoft.AspNetCore.SignalR.Common (nuget) >= 8.0.0, <= 8.0.31; Microsoft.AspNetCore.SignalR.Common (nuget) >= 9.0.0, <= 9.0.20
Fix
Upgrade Microsoft.AspNetCore.SignalR.Common to 10.0.13 or 11.0.0-rc.2 or 8.0.32 or 9.0.21 (whichever matches your release line) or later.
Exploitation
No known exploitation

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: asp.net core, NuGet

Affected packages

PackageEcosystemVulnerableFixed in
Microsoft.AspNetCore.SignalR.Commonnuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.AspNetCore.SignalR.Commonnuget>= 11.0.0-preview.5, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.AspNetCore.SignalR.Commonnuget>= 8.0.0, <= 8.0.318.0.32
Microsoft.AspNetCore.SignalR.Commonnuget>= 9.0.0, <= 9.0.209.0.21

References

Original description

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.