CVE-2019-0982: Denial of service in ASP.NET Core
Summary
CVE-2019-0982: Denial of service in ASP.NET Core. Affects Microsoft.AspNetCore.SignalR.Protocols.MessagePack across 2 version ranges.
>= 1.0.0, < 1.0.11
>= 1.1.0, < 1.1.5
Fixed in 1.0.11 or 1.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Microsoft.AspNetCore.SignalR.Protocols.MessagePack package is a NuGet package that provides support for the MessagePack protocol in ASP.NET Core SignalR. SignalR is a real-time web framework that enables bi-directional communication between clients and servers. The MessagePack protocol is a binary serialization format that is used for efficient data exchange. This vulnerability affects versions 1.0.0 to 1.0.11 and 1.1.0 to 1.1.5 of the Microsoft.AspNetCore.SignalR.Protocols.MessagePack package.
Vulnerability Detail
A denial of service vulnerability exists in ASP.NET Core when it improperly handles web requests. This vulnerability can be exploited by an attacker to send specially crafted web requests that can cause the application to become unresponsive or crash. The vulnerability has a CVSS score of 7.5, indicating a high severity. It can lead to a disruption of service and impact the availability of the affected application.
How To Fix
Latest published version: 10.0.13 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.111.0.11 -
>= 1.1.0, < 1.1.51.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the Microsoft.AspNetCore.SignalR.Protocols.MessagePack package to a fixed version.
Conclusion
In conclusion, the Microsoft.AspNetCore.SignalR.Protocols.MessagePack package is vulnerable to a denial of service vulnerability in ASP.NET Core. It is crucial to upgrade to a fixed version of the package to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Microsoft.AspNetCore.SignalR.Protocols.MessagePack →
FAQ
ASP.NET Core is a cross-platform, open-source framework for building modern, cloud-based web applications. It provides a unified programming model for building web APIs, web applications, and microservices.
SignalR is a real-time web framework for building interactive web applications. It enables bi-directional communication between clients and servers, allowing real-time updates and notifications.
The MessagePack protocol is a binary serialization format that is used for efficient data exchange. It is designed to be fast and compact, making it suitable for use in real-time communication scenarios.
A denial of service vulnerability is a security flaw that allows an attacker to disrupt the normal functioning of a system or application. In the case of this vulnerability, it can be exploited to cause the ASP.NET Core application to become unresponsive or crash.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.AspNetCore.SignalR.Protocols.MessagePack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
