If a customer app uses SignalR with a Redis backplane, check its deployed package as well as its ASP.NET Core runtime. Microsoft’s November 11, 2026 CVRF now explicitly maps the standalone package’s 8.x and 9.x fixes. The original CVE and maintainer advisory were published November 10.
Where this matters
CVE-2026-114147 can exhaust resources in an ASP.NET Core SignalR deployment using the Redis scale-out provider. The maintainer advisory describes a case-mismatched group removal that can leave subscriptions behind. Confirm the application actually uses that provider and whether untrusted network clients reach the SignalR service.
Vendor rating Important in MSRC and High in the Microsoft maintainer advisory, CVSS 3.1 7.5. MSRC reports no public disclosure or known exploitation and assesses exploitation Less Likely. CISA KEV has no matching entry. Suggested MSP priority Expedite exposed or business-critical SignalR services using the affected provider. Last verified November 12, 2026 UTC.
Affected package and runtime ranges
Microsoft lists these ranges for Microsoft.AspNetCore.SignalR.StackExchangeRedis and the affected ASP.NET Core runtime packages across the Windows, Linux and macOS architectures in its advisory.
| Affected versions (inclusive) | Fixed version |
|---|---|
| 8.0.0-preview.1.23112.2 through 8.0.33 | 8.0.34 |
| 9.0.0-preview.1.24081.5 through 9.0.22 | 9.0.23 |
| 10.0.0-preview.1.25120.3 through 10.0.14 | 10.0.15 |
| 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148 | 11.0.0 |
Inventory deployed dependencies and runtime versions. Update the standalone reference where present and apply the applicable runtime servicing update. Rebuild and redeploy self-contained apps or images. Verify the resolved dependency and runtime on every replica and test SignalR group behavior. If patching is delayed, restrict unneeded external access to the affected service where feasible. No vendor workaround or compromise-check requirement was verified.
Microsoft maintainer advisory · MSRC advisory · MSRC November CVRF · CISA KEV