ASP.NET Core SignalR EUVD-2026-99691

Exploitable only against ASP.NET Core applications using the affected SignalR packages (Microsoft.AspNetCore.SignalR.Common / SignalR.Core) that have SignalR stateful reconnect enabled - the flaw is specifically in stateful-reconnect handling via MessageBuffer.ResendAsync backpressure, so hubs without stateful reconnect are not affected. No authentication is required (PR:N) and no user interaction (UI:N), and the SignalR endpoint must be network-reachable by the attacker. The key limiting factor is this non-default stateful-reconnect configuration; applications that do not opt into stateful reconnect, or that have patched to the fixed package versions, are not exposed.

Signals are moderate and internally consistent, pointing to a genuine-but-not-urgent availability issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) indicates a remote, unauthenticated, low-complexity network attack with impact confined to availability - there is no confidentiality or integrity loss, so this is a pure denial-of-service. CISA SSVC reinforces this: Exploitation=none (no observed or public exploitation), Automatable=yes (the trigger can be scripted/repeated at scale), Technical Impact=partial (service degradation, not full system takeover). The vulnerability is NOT in CISA KEV and no public exploit code was provided, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input and cannot be assessed - this is a data gap. The most important nuance the raw 7.5 score hides is the exploitation precondition: per the dotnet/aspnetcore GHSA advisory, the flaw lives in SignalR stateful reconnect handling (MessageBuffer.ResendAsync backpressure), so only applications that have enabled SignalR with stateful reconnect are actually exposed. That non-default configuration dependency means the real-world attack surface is narrower than the AC:L/PR:N vector alone implies. Net: a legitimate, vendor-confirmed, patch-available DoS worth remediating on normal patch cadence, but not a drop-everything issue absent evidence of active exploitation.

An attacker connects to an exposed ASP.NET Core SignalR hub that has stateful reconnect enabled and, acting as a stateful reconnect client, induces backpressure through MessageBuffer.ResendAsync so that server broadcasts are indefinitely blocked and associated buffers/resources are retained. Repeating this across connections exhausts resources and denies service to legitimate users. No public exploit code was identified at time of analysis, and no authentication is required per the CVSS vector.