CVE-2026-70159

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can completely disrupt real-time communication services and exhaust host resources without requiring privileges or user interaction. In Red Hat Enterprise Linux environments running .NET applications, exposure is limited to deployments hosting ASP.NET Core SignalR endpoints that utilize stateful reconnection features. Standard HTTP services or SignalR hubs operating without stateful reconnect enabled are not susceptible to this starvation condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.