---
id: "GHSA-gxg8-5rwf-cg43"
page: "https://infrastack.ai/live/GHSA-gxg8-5rwf-cg43"
kind: "vulnerability"
aliases: ["GHSA-gxg8-5rwf-cg43"]
title: "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "Microsoft.AspNetCore.SignalR.StackExchangeRedis", "fixed": [], "affected": ">= 8.0.0-preview.1.23112.2, <= 8.0.33", "ecosystem": "nuget"}]
ecosystems: ["nuget"]
tags: ["aspnetcore", "cwe-401", "dotnet", "package", "redis", "signalr"]
not_affected_if: ["no-signalr-redis", "outside-affected-range"]
published_at: "2026-11-10T21:32:51+00:00"
first_seen_at: "2026-11-10T22:07:08+00:00"
updated_at: "2026-11-10T22:07:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gxg8-5rwf-cg43", "first_seen_at": "2026-11-10T22:07:08+00:00"}]
exploit_sources: []
---

# Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability

Link for people: https://infrastack.ai/live/GHSA-gxg8-5rwf-cg43 (this .md is for agents)

This advisory is a withdrawn duplicate of GHSA-wr8v-9x5q-ggcm and is kept only for external links. The original text says ASP.NET Core fails to release memory after its useful lifetime, so an unauthenticated network attacker can exhaust resources and deny service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:Microsoft.AspNetCore.SignalR.StackExchangeRedis affected >= 8.0.0-preview.1.23112.2, <= 8.0.33 fixed no fixed version listed

## How to check

- Check whether the project references `Microsoft.AspNetCore.SignalR.StackExchangeRedis` in its NuGet packages.
- Confirm the version in use falls in the affected range `8.0.0-preview.1.23112.2` to `8.0.33`.
- See GHSA-wr8v-9x5q-ggcm for the live advisory and its fixed version.

## Timeline

- 2026-11-10T22:07:08+00:00 ghsa https://github.com/advisories/GHSA-gxg8-5rwf-cg43

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references.

## Original Description
Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_