{"id":"GHSA-gxg8-5rwf-cg43","kind":"vulnerability","aliases":["GHSA-gxg8-5rwf-cg43"],"related":[],"title":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references.\n\n## Original Description\nMissing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.","summary":"This advisory is a withdrawn duplicate of GHSA-wr8v-9x5q-ggcm and is kept only for external links. The original text says ASP.NET Core fails to release memory after its useful lifetime, so an unauthenticated network attacker can exhaust resources and deny service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","fixed":[],"affected":">= 8.0.0-preview.1.23112.2, <= 8.0.33","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["aspnetcore","cwe-401","dotnet","package","redis","signalr"],"not_affected_if":["no-signalr-redis","outside-affected-range"],"how_to_check":"- Check whether the project references `Microsoft.AspNetCore.SignalR.StackExchangeRedis` in its NuGet packages.\n- Confirm the version in use falls in the affected range `8.0.0-preview.1.23112.2` to `8.0.33`.\n- See GHSA-wr8v-9x5q-ggcm for the live advisory and its fixed version.","fix":null,"status":"withdrawn","published_at":"2026-11-10T21:32:51+00:00","first_seen_at":"2026-11-10T22:07:08+00:00","triaged_at":"2026-11-10T22:07:40+00:00","updated_at":"2026-11-10T22:07:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T22:07:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASP.NET Core SignalR Redis: memory leak lets attackers deny service","impact":"medium","summary":"This advisory is a withdrawn duplicate of GHSA-wr8v-9x5q-ggcm and is kept only for external links. The original text says ASP.NET Core fails to release memory after its useful lifetime, so an unauthenticated network attacker can exhaust resources and deny service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["aspnetcore","signalr","dotnet","redis"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Service becomes unavailable through memory exhaustion over the network","analyst_note":"","how_to_check":"- Check whether the project references `Microsoft.AspNetCore.SignalR.StackExchangeRedis` in its NuGet packages.\n- Confirm the version in use falls in the affected range `8.0.0-preview.1.23112.2` to `8.0.33`.\n- See GHSA-wr8v-9x5q-ggcm for the live advisory and its fixed version.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-signalr-redis","outside-affected-range"],"who_is_affected":"Applications that use the SignalR Redis backplane from the ASP.NET Core 8.0 line in the affected version range are exposed. Apps not using SignalR with a Redis backplane can skip it. The live advisory GHSA-wr8v-9x5q-ggcm holds the authoritative details.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4672,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114147':8A '-2026':7A '-401':28B '5rwf':18A,23A '9x5q':43B,93C 'advisori':2A,5A,34B,78C,80C 'allow':115C 'asp.net':9A,56B,113C 'aspnetcor':26B 'attack':70B,118C 'cg43':19A,24A 'core':10A,57B,114C 'cve':6A 'cwe':27B 'deni':75B,120C 'denial':11A 'descript':104C 'dotnet':29B 'duplic':1A,38B,77C,88C 'effect':110C 'exhaust':72B 'extern':50B,101C 'fail':58B 'ggcm':44B,94C 'ghsa':16A,21A,41B,91C 'ghsa-gxg8-5rwf-cg43':15A,20A 'ghsa-wr8v-9x5q-ggcm':40B,90C 'gxg8':17A,22A 'kept':47B 'lifetim':65B,111C 'link':51B,96C 'maintain':98C 'memori':61B,108C 'microsoft':3A 'microsoft.aspnetcore.signalr.stackexchangeredis':25A 'miss':105C 'network':69B,124C 'origin':53B,103C 'packag':30B 'preserv':100C 'redi':31B 'refer':102C 'releas':60B,106C 'resourc':73B 'say':55B 'secur':4A 'servic':13A,76B,121C 'signalr':32B 'text':54B 'unauthent':68B 'unauthor':117C 'use':64B 'vulner':14A 'withdrawn':37B,83C 'wr8v':42B,92C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the SignalR Redis backplane from the ASP.NET Core 8.0 line in the affected version range are exposed. Apps not using SignalR with a Redis backplane can skip it. The live advisory GHSA-wr8v-9x5q-ggcm holds the authoritative details.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftaspnetcoresignalrstackexchangeredis"],"ptokens":["aspnetcore","microsoft","signalr","stackexchangeredis"],"labels":["aspnetcore","cwe401","dotnet","high","nuget","package","redis","signalr"],"campaign_type":null,"search_a":"'-114147':8A '-2026':7A '5rwf':18A,23A 'advisori':2A,5A 'asp.net':9A 'cg43':19A,24A 'core':10A 'cve':6A 'denial':11A 'duplic':1A 'ghsa':16A,21A 'ghsa-gxg8-5rwf-cg43':15A,20A 'gxg8':17A,22A 'microsoft':3A 'microsoft.aspnetcore.signalr.stackexchangeredis':25A 'secur':4A 'servic':13A 'vulner':14A","search_b":"'-401':28B '9x5q':43B 'advisori':34B 'asp.net':56B 'aspnetcor':26B 'attack':70B 'core':57B 'cwe':27B 'deni':75B 'dotnet':29B 'duplic':38B 'exhaust':72B 'extern':50B 'fail':58B 'ggcm':44B 'ghsa':41B 'ghsa-wr8v-9x5q-ggcm':40B 'kept':47B 'lifetim':65B 'link':51B 'memori':61B 'network':69B 'origin':53B 'packag':30B 'redi':31B 'releas':60B 'resourc':73B 'say':55B 'servic':76B 'signalr':32B 'text':54B 'unauthent':68B 'use':64B 'withdrawn':37B 'wr8v':42B","search_c":"'9x5q':93C 'advisori':78C,80C 'allow':115C 'asp.net':113C 'attack':118C 'core':114C 'deni':120C 'descript':104C 'duplic':77C,88C 'effect':110C 'extern':101C 'ggcm':94C 'ghsa':91C 'ghsa-wr8v-9x5q-ggcm':90C 'lifetim':111C 'link':96C 'maintain':98C 'memori':108C 'miss':105C 'network':124C 'origin':103C 'preserv':100C 'refer':102C 'releas':106C 'servic':121C 'unauthor':117C 'withdrawn':83C 'wr8v':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:32:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gxg8-5rwf-cg43","url":"https://github.com/advisories/GHSA-gxg8-5rwf-cg43","severity":"high","published_at":"2026-11-10T21:32:51+00:00","modified_at":"2026-11-10T22:06:16+00:00","first_seen_at":"2026-11-10T22:07:08+00:00","fetched_at":"2026-11-10T22:12:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}