CVE-2026-45591

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A vulnerability (CVE-2026-45591) exists in ASP.NET Core MessagePack handling used by SignalR and Blazor Server scenarios. Microsoft describes the issue as uncontrolled resource consumption in ASP.NET Core that allows an unauthorized attacker to deny service over a network.

HeroDevs investigation traced the .NET 6 NES impact to MessagePack handling used by SignalR and Blazor Server. The vulnerable code path used recursive skipping for nested MessagePack arrays and maps. A deeply nested MessagePack payload could exhaust process stack or other resources and interrupt service availability.

Per CWE-400: Uncontrolled Resource Consumption, the software does not properly control allocation and maintenance of a limited resource, enabling an attacker to influence resource consumption and cause availability impact.

This issue affects ASP.NET Core in NES-supported .NET 6. The two delivery paths were remediated separately: Blazor Server, where the MessagePack reader is compiled into the ASP.NET Core shared framework, is fixed in 6.0.41; the standalone Microsoft.AspNetCore.SignalR.Protocols.MessagePack package, which resolves MessagePack as an external dependency, is fixed in 6.0.42. Applications using SignalR's MessagePack hub protocol therefore need 6.0.42 or later. Microsoft also serviced supported ASP.NET Core releases in its June 9, 2026 security updates for .NET 8.0, .NET 9.0, and .NET 10.0

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

‍

Details

Module Info

• Product:
  
  • Any NES for .NET 6 ASP.NET Core installation at version 6.0.40 or earlier (6.0.41 or earlier for the SignalR MessagePack package) that processes MessagePack payloads.
• Affected packages:
  
  • ASP.NET Core shared framework
  • SignalR / Blazor Server MessagePack protocol handling
• Affected versions:
  
  • Blazor Server (ASP.NET Core shared framework): >= 6.0.0 <= 6.0.40
  • Microsoft.AspNetCore.SignalR.Protocols.MessagePack: >= 6.0.0 <= 6.0.41
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  
  • NuGet
  • ASP.NET Core shared framework
  • Windows Installer
  • Docker
• Fixed in: NES for .NET 6.0.41 (Blazor Server) / 6.0.42 (Microsoft.AspNetCore.SignalR.Protocols.MessagePack).

Vulnerability Info

This High-severity vulnerability is found in ASP.NET Core MessagePack protocol handling. Applications that use SignalR or Blazor Server MessagePack can process attacker-controlled network payloads. Before the fix, nested arrays and maps could be skipped recursively, causing resource exhaustion for sufficiently deep input.

The NES backport changes the relevant MessagePack reader skip logic to handle deeply nested structures without uncontrolled recursion, preserving service availability for malformed or malicious payloads.

‍

Mitigation

.NET 6.x is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  
  • NES for .NET 6.0.41 or later (Blazor Server) / 6.0.42 or later (SignalR MessagePack)
  • .NET / ASP.NET Core 8.0.28 or later
  • .NET / ASP.NET Core 9.0.17 or later
  • .NET / ASP.NET Core 10.0.9 or later
• Limit exposure of MessagePack-based hubs and endpoints to trusted clients where possible until patched.
• Monitor service health for repeated malformed MessagePack traffic and unexpected process termination.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.41 or later (6.0.42 or later for SignalR MessagePack).

‍

Credits

• Anonymous