{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "<a href=\"https://vincent55.tw/\">Vincent55 Yang</a>"
        ]
      },
      {
        "names": [
          "nono"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-70159 ASP.NET Core Denial of Service Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70159"
      },
      {
        "category": "self",
        "summary": "CVE-2026-70159 ASP.NET Core Denial of Service Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-70159.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "ASP.NET Core Denial of Service Vulnerability",
    "tracking": {
      "current_release_date": "2026-10-15T07:00:00.000Z",
      "generator": {
        "date": "2026-11-03T01:25:21.571Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-70159",
      "initial_release_date": "2026-10-13T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-13T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-10-15T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated the Security Updates table to add KB article links for .NET 11.0 and download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "13"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-20837"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "14"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-20839"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "15"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-20838"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-20837"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-20839"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-20838"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "16"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-21783"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "17"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-21785"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "18"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-21784"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "4"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-21783"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-21785"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-21784"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "19"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-12414"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "20"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-12415"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "21"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-12416"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "7"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-12414"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "8"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-12415"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "9"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-12416"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "22"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-12434"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "23"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-12432"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common <9.0.21",
                  "product_id": "24"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.21",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Common 9.0.21",
                  "product_id": "21958-12433"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Common"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "10"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-12434"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "11"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-12432"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core <1.2.14",
                  "product_id": "12"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.14",
                "product": {
                  "name": "Microsoft.AspNetCore.SignalR.Core 1.2.14",
                  "product_id": "21959-12433"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft.AspNetCore.SignalR.Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<18.10.4",
                "product": {
                  "name": "Microsoft Visual Studio 2026 version 18.10 <18.10.4",
                  "product_id": "25"
                }
              },
              {
                "category": "product_version",
                "name": "18.10.4",
                "product": {
                  "name": "Microsoft Visual Studio 2026 version 18.10 18.10.4",
                  "product_id": "21956"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft Visual Studio 2026 version 18.10"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<17.14.42",
                "product": {
                  "name": "Microsoft Visual Studio 2022 version 17.14 <17.14.42",
                  "product_id": "26"
                }
              },
              {
                "category": "product_version",
                "name": "17.14.42",
                "product": {
                  "name": "Microsoft Visual Studio 2022 version 17.14 17.14.42",
                  "product_id": "16767"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft Visual Studio 2022 version 17.14"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-70159",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "16767",
          "21956",
          "21958-12414",
          "21958-12415",
          "21958-12416",
          "21958-12432",
          "21958-12433",
          "21958-12434",
          "21958-20837",
          "21958-20838",
          "21958-20839",
          "21958-21783",
          "21958-21784",
          "21958-21785",
          "21959-12414",
          "21959-12415",
          "21959-12416",
          "21959-12432",
          "21959-12433",
          "21959-12434",
          "21959-20837",
          "21959-20838",
          "21959-20839",
          "21959-21783",
          "21959-21784",
          "21959-21785"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-70159 ASP.NET Core Denial of Service Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70159"
        },
        {
          "category": "self",
          "summary": "CVE-2026-70159 ASP.NET Core Denial of Service Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-70159.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T07:00:00.000Z",
          "details": "10.0.13:Security Update:https://github.com/dotnet/announcements/issues/452",
          "product_ids": [
            "13",
            "14",
            "15"
          ],
          "url": "https://github.com/dotnet/announcements/issues/452"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-13T07:00:00.000Z",
          "details": "1.2.14:Security Update:https://github.com/dotnet/announcements/issues/452",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12"
          ],
          "url": "https://github.com/dotnet/announcements/issues/452"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-13T07:00:00.000Z",
          "details": "11.0.0-rc.2:Security Update:https://github.com/dotnet/announcements/issues/452",
          "product_ids": [
            "16",
            "17",
            "18"
          ],
          "url": "https://github.com/dotnet/announcements/issues/452"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-13T07:00:00.000Z",
          "details": "8.0.32:Security Update:https://github.com/dotnet/announcements/issues/452",
          "product_ids": [
            "19",
            "20",
            "21"
          ],
          "url": "https://github.com/dotnet/announcements/issues/452"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-13T07:00:00.000Z",
          "details": "9.0.21:Security Update:https://github.com/dotnet/announcements/issues/452",
          "product_ids": [
            "22",
            "23",
            "24"
          ],
          "url": "https://github.com/dotnet/announcements/issues/452"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-13T07:00:00.000Z",
          "details": "18.10.4:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes",
          "product_ids": [
            "25"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-13T07:00:00.000Z",
          "details": "17.14.42:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "26"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21",
            "22",
            "23",
            "24",
            "25",
            "26"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Denial of Service"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "ASP.NET Core Denial of Service Vulnerability"
    }
  ]
}