--- id: "CVE-2026-114147" page: "https://infrastack.ai/live/CVE-2026-114147" kind: "vulnerability" aliases: ["CVE-2026-114147", "GHSA-wr8v-9x5q-ggcm"] title: "Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability" severity: "high" cvss: 7.5 epss: null exploited: false status: "open" category: "package" products: [{"name": "Microsoft.AspNetCore.App", "fixed": ["8.0.34", "9.0.23", "10.0.15", "11.0.0"], "affected": "8.0 < 8.0.34; 9.0 < 9.0.23; 10.0 < 10.0.15; 11.0 pre-release", "ecosystem": "dotnet"}, {"name": "Microsoft.AspNetCore.SignalR.StackExchangeRedis", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.SignalR.StackExchangeRedis", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.SignalR.StackExchangeRedis", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.SignalR.StackExchangeRedis", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["8.0.34"], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["9.0.23"], "affected": ">= 9.0.0-preview.1.24081.5, <= 9.0.22", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["10.0.15"], "affected": ">= 10.0.0-preview.1.25120.3, <= 10.0.14", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x64", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}, {"name": "Microsoft.AspNetCore.App.Runtime.win-x86", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148", "ecosystem": "nuget"}] ecosystems: ["dotnet", "nuget"] tags: ["aspnet-core", "cwe-401", "dotnet", "package", "redis", "runtime", "self-hosted", "signalr"] not_affected_if: ["no-signalr-redis-backplane", "patched-versions"] published_at: "2026-11-10T19:19:07+00:00" first_seen_at: "2026-11-10T19:24:43+00:00" updated_at: "2026-11-11T00:25:36+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114147", "first_seen_at": "2026-11-10T19:24:43+00:00"}, {"source": "analyst", "url": "https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/", "first_seen_at": "2026-11-10T23:47:07+00:00", "cites": ["https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/", "https://cvefeed.io/vuln/detail/CVE-2026-114147"]}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-wr8v-9x5q-ggcm", "first_seen_at": "2026-11-11T00:24:44+00:00"}] exploit_sources: [] --- # Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability Link for people: https://infrastack.ai/live/CVE-2026-114147 (this .md is for agents) ASP.NET Core's SignalR Redis scale-out can mishandle removal of groups when the name case does not match, leaving subscriptions in a state that keeps consuming resources. An attacker can cause persistent resource amplification and denial of service on the server. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - dotnet:Microsoft.AspNetCore.App affected 8.0 < 8.0.34; 9.0 < 9.0.23; 10.0 < 10.0.15; 11.0 pre-release fixed 8.0.34, 9.0.23, 10.0.15, 11.0.0 - nuget:Microsoft.AspNetCore.SignalR.StackExchangeRedis affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.SignalR.StackExchangeRedis affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.SignalR.StackExchangeRedis affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.SignalR.StackExchangeRedis affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed 8.0.34 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 9.0.0-preview.1.24081.5, <= 9.0.22 fixed 9.0.23 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 10.0.0-preview.1.25120.3, <= 10.0.14 fixed 10.0.15 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-musl-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.linux-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.osx-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.osx-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-arm64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-x64 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 - nuget:Microsoft.AspNetCore.App.Runtime.win-x86 affected >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 fixed 11.0.0 ## How to check - Check the ASP.NET Core runtime version with `dotnet --list-runtimes` and compare it with the affected ranges. - Check the resolved `Microsoft.AspNetCore.SignalR.StackExchangeRedis` version in each project's package references or lock file. - Look for SignalR with the Redis backplane (`AddStackExchangeRedis`) in the application startup code. ## Fix - Microsoft.AspNetCore.SignalR.StackExchangeRedis: `8.0.34` for 8.0, `9.0.23` for 9.0, `10.0.15` for 10.0, `11.0.0` for 11.0. - ASP.NET Core runtime: `8.0.34` for 8.0, `9.0.23` for 9.0, `10.0.15` for 10.0, `11.0.0` for 11.0. ## Timeline - 2026-11-10T19:24:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114147 - 2026-11-10T23:47:07+00:00 analyst https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/ — Fixed versions from Microsoft's Nov 2026 .NET servicing blog (primary). MSRC page not fetchable, so exact lower bounds and the vulnerable code path are unconfirmed; affected ranges inferred as below the fixed version. No exploitation or PoC found. CVSS 7.5. - 2026-11-11T00:24:44+00:00 ghsa https://github.com/advisories/GHSA-wr8v-9x5q-ggcm ## Documents - [advisory] .NET and .NET Framework November 2026 servicing updates https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/ - [advisory] Maintainer's advisory: github.com https://github.com/dotnet/aspnetcore/security/advisories/GHSA-wr8v-9x5q-ggcm - [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-wr8v-9x5q-ggcm - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34 - [fix] Release: github.com https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23 - [fix] Patch: github.com https://github.com/dotnet/aspnetcore/commit/cc53379f74963c4509ddfa91845132146d7054aa - [fix] Patch: github.com https://github.com/dotnet/aspnetcore/commit/d94f9c231ee7e047c5c3c4cfdabe862274938faf - [mentions] CVE-2026-114147 - cvefeed https://cvefeed.io/vuln/detail/CVE-2026-114147 ## From the sources ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/509 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-401 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately. ### 8.0 - standalone packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 ### 9.0 - standalone packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 ### 10.0 - standalone packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 ### 11.0 - standalone packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 ### .NET 8.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 ### .NET 9.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 ### .NET 10.0 - affected runtime packages Package | Affected version | Patched version --- | --- | --- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 [Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Run --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_