CVE-2026-45591 is a vulnerability in the MessagePack hub protocol used by ASP.NET Core SignalR and Blazor Server, where insufficient validation of message nesting depth allows a remote attacker to send specially crafted MessagePack payloads with deeply nested arrays. This triggers excessive recursion and a stack overflow during message processing, causing the affected application or service to terminate unexpectedly and resulting in a denial of service condition. Red Hat has released an official fix for this issue as part of an update to Red Hat Hardened Images RPMs, including various dotnet10.0 packages. The vulnerability is tracked under multiple CWEs related to resource consumption and memory corruption. No known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated remote attacker to cause a denial of service by triggering a stack overflow through deeply nested MessagePack arrays. This results in application or service termination, impacting availability. There is no impact on confidentiality or integrity reported.

An official fix is available from Red Hat and should be applied to affected systems. Red Hat does not currently provide a practical temporary workaround that meets usability and stability standards. Customers should update to the fixed versions of the affected RPMs as soon as possible to mitigate this vulnerability.