DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-56170: CVE-2026-56170: Remote Denial of Service via Resource Exhaustion in ASP.NET Core

#security #cve #cybersecurity

CVE-2026-56170: Remote Denial of Service via Resource Exhaustion in ASP.NET Core

Vulnerability ID: CVE-2026-56170
CVSS Score: 7.5
Published: 2026-07-21

CVE-2026-56170 is a high-severity Remote Denial of Service (DoS) vulnerability in Microsoft's ASP.NET Core framework. The vulnerability spans three separate resource-management vectors within the ASP.NET Core ecosystem, including SignalR Stateful Reconnect allocations, JSON Patch Type Confusion leading to stack exhaustion, and Kestrel HTTP/2 synchronization issues. An unauthenticated remote attacker can exploit these issues to cause process-terminating exceptions, rendering applications unavailable.

TL;DR

A remote, unauthenticated attacker can exploit multiple resource-allocation weaknesses (CWE-770) within ASP.NET Core to exhaust heap memory or trigger unhandled stack overflows, leading to a complete Denial of Service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS Score: 7.5 (High)
  • EPSS Score: 0.00798 (Percentile: 52.50%)
  • Impact: Denial of Service (DoS)
  • Exploit Status: Theoretical / Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • ASP.NET Core applications built on .NET 8.0
  • ASP.NET Core applications built on .NET 9.0
  • ASP.NET Core applications built on .NET 10.0
  • Applications implementing Microsoft.AspNetCore.JsonPatch.SystemTextJson
  • Applications implementing SignalR with Stateful Reconnect enabled
  • ASP.NET Core 8.0: >= 8.0.0, < 8.0.29 (Fixed in: 8.0.29)
  • ASP.NET Core 9.0: >= 9.0.0, < 9.0.18 (Fixed in: 9.0.18)
  • ASP.NET Core 10.0: >= 10.0.0, < 10.0.6 (Fixed in: 10.0.6)

Code Analysis

Commit: 73c3f25

Fix type checking in ListAdapter by ensuring target implements generic IList and introducing type-safe elements accessor helper to replace legacy IList casts.

Commit: ca933ee

Update Newtonsoft JsonPatch document parsing configurations and test definitions to reflect resource constraint requirements.

Commit: 7ded2a0

Harden Kestrel HTTP/2 connection processing logic to prevent stream header writes from racing with stream termination abort signals.

Commit: 78e6f5a

Introduce synchronization tests for HTTP/2 connection resets and state validation on closed streams in Kestrel.

Mitigation Strategies

  • Upgrade the .NET Runtime and SDK to patched baseline versions
  • Disable or reduce the buffer size of the SignalR Stateful Reconnect feature
  • Enforce maximum request body limits at the Kestrel web server boundary
  • Validate input paths and collection types before processing JSON Patch requests

Remediation Steps:

  1. Identify all hosts running vulnerable .NET Runtimes (8.0.x < 8.0.29, 9.0.x < 9.0.18, 10.0.x < 10.0.6).
  2. Apply runtime and SDK updates using system package managers or official installers.
  3. In applications utilizing SignalR, audit the Hub configurations to set StatefulReconnectBufferSize to safe thresholds or 0.
  4. Restart the affected web application pools, Docker containers, or system services to load the updated runtime libraries.

References

Read the full report for CVE-2026-56170 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)