GHSA-86xp-94pg-8r6r: Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Protocols.MessagePack; MessagePack; MessagePack.Annotations; MessagePackAnalyzer. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

SignalR’s MessagePack protocol can consume excessive memory while deserializing deeply nested attacker-controlled arrays, resulting in unauthenticated remote denial of service.