CVE-2026-70159: CWE-770: Allocation of Resources Without Limits or Throttling in Microsoft Microsoft Visual Studio 2022 version 17.14

This vulnerability, identified as CWE-770, occurs in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core packages where SignalR stateful reconnect clients can indefinitely block broadcasts through the MessageBuffer.ResendAsync backpressure mechanism, causing resource retention without limits or throttling. This can result in denial of service conditions by exhausting resources. The affected packages include versions >=10.0.0 and <=10.0.12 for SignalR.Common, >=1.0.0 and <=1.2.13 for SignalR.Core, and other specified version ranges. Microsoft has provided patched versions to address this issue.

The vulnerability allows an attacker to cause a denial of service by making SignalR clients block broadcasts indefinitely, leading to resource exhaustion. There is no impact on confidentiality or integrity, but availability is severely affected. This can disrupt applications relying on SignalR for real-time communication.

An official fix is available. Users should update to the patched versions of the affected packages: Microsoft.AspNetCore.SignalR.Common to 10.0.13, 11.0.0-rc.2, 8.0.32, or 9.0.21 as applicable, and Microsoft.AspNetCore.SignalR.Core to 1.2.14. Additionally, updating to the latest .NET runtime or SDK and restarting applications is required. Self-contained applications must be recompiled and redeployed with the updated packages. Follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70159.