CVE-2026-114147

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-114147) exists in ASP.NET Core SignalR's Redis scale-out support. Microsoft describes the issue as missing release of memory in ASP.NET Core that allows an unauthorized attacker to deny service over a network: removing a connection from a group whose name differs in case can leave Redis subscriptions behind, which permits persistent resource amplification.

Per CWE-401: Missing Release of Memory after Effective Lifetime, the weakness is a product not sufficiently tracking and releasing allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

In .NET 6 the vulnerable code ships only in the opt-in Microsoft.AspNetCore.SignalR.StackExchangeRedis NuGet package, not in the ASP.NET Core shared framework. Only applications that scale SignalR out over Redis with AddStackExchangeRedis are exposed, on any platform. Updating the installed runtime does not fix .NET 6 applications: update the package reference, then rebuild and redeploy. Microsoft serviced 8.0 through 11.0 in its November 10, 2026 security updates.

Details

Module Info

• Product: Any ASP.NET Core application that uses SignalR Redis scale-out through Microsoft.AspNetCore.SignalR.StackExchangeRedis
• Affected packages: Microsoft.AspNetCore.SignalR.StackExchangeRedis (opt-in NuGet package; for 8.0 and later Microsoft also lists the ASP.NET Core runtime packs at the same versions)
• Affected versions:
  • >= 6.0.0, <= 6.0.48 (NES for .NET 6)
  • >= 8.0.0-preview.1.23112.2, <= 8.0.33
  • >= 9.0.0-preview.1.24081.5, <= 9.0.22
  • >= 10.0.0-preview.1.25120.3, <= 10.0.14
  • >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148
• Package manager: NuGet
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Microsoft.AspNetCore.SignalR.StackExchangeRedis on NuGet
• Fixed in: NES for .NET 6.0.49 (Microsoft.AspNetCore.SignalR.StackExchangeRedis 6.0.49)

Vulnerability Info

This High-severity vulnerability is found in RedisHubLifetimeManager<THub> in the Microsoft.AspNetCore.SignalR.StackExchangeRedis package.

With Redis scale-out, each SignalR group maps to a Redis pub/sub channel. When a connection joins a group, the server subscribes to that group's channel, and it releases the subscription when the connection leaves the group or disconnects. In affected versions, the manager tracked each connection's groups in a case-insensitive set, while the Redis channel names and the subscription store compare names case-sensitively. Adding a connection to customgroup and then removing it from CUSTOMGROUP removed the name from the set but left the customgroup subscription in place, and nothing released it afterwards, not even disconnect. Repeating the pattern grows the server's Redis subscriptions and their bookkeeping without limit, leading to denial of service.

NES for .NET 6.0.49 matches Microsoft's fix. Group names are tracked with case-sensitive (ordinal) comparison, matching the channel names, and the group set and the Redis subscription are updated together under one lock, including during disconnect, so the two cannot drift apart.

This vulnerability has been present since at least ASP.NET Core 6.0.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications, both the ASP.NET Core Runtime and Microsoft.AspNetCore.SignalR.StackExchangeRedis, to one of:
  • 10.0.15 or later
  • 11.0.0 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later (Microsoft.AspNetCore.SignalR.StackExchangeRedis 6.0.49).

Credits

Microsoft's advisory acknowledges 71C4 with ARPSEC for this vulnerability.