MICROSOFT.ASPNETCORE.SIGNALR.STACKEXCHANGEREDIS · GHSA-gxg8-5rwf-cg43 · Package
NO FIX YET
This advisory is a withdrawn duplicate of GHSA-wr8v-9x5q-ggcm and is kept only for external links. The original text says ASP.NET Core fails to release memory after its useful lifetime, so an unauthenticated network attacker can exhaust resources and deny service.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use the SignalR Redis backplane from the ASP.NET Core 8.0 line in the affected version range are exposed. Apps not using SignalR with a Redis backplane can skip it. The live advisory GHSA-wr8v-9x5q-ggcm holds the authoritative details.
Not affected if no-signalr-redis, outside-affected-range
Who cares aspnetcore, dotnet, redis, signalr
Microsoft.AspNetCore.SignalR.StackExchangeRedis in its NuGet packages.8.0.0-preview.1.23112.2 to 8.0.33.No fix yet, per the sources.
This advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references.
Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.