UBUNTU-CVE-2026-114147: High severity ubuntu/dotnet6 vulnerability
SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using SignalR with Redis scale-out are affected. The listed Ubuntu packages are dotnet6, dotnet8, dotnet10, and dotnet11.
Does exploiting this require authentication or user interaction?
No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.
What is the likely operational impact?
A case-mismatched group removal can leave subscriptions in a state that allows persistent resource amplification, resulting in denial of service. The supplied impact vector indicates availability impact without confidentiality or integrity impact.