Repository navigation
Fix MessageBuffer.ResendAsync and send-side FIN DoS - #10241
Merged
Merged
Conversation
…d-side FIN DoS Prevents malicious or abruptly disconnected stateful-reconnect clients from indefinitely blocking SignalR broadcasts and retaining server resources. Healthy reconnects remain unaffected as long as replay continues making progress. - [ ] Yes - [x] No - [ ] High - [x] Medium - [ ] Low The code change is localized to the opt-in stateful reconnect path, but it modifies concurrency, cancellation, timer, and connection-abort behavior shared by both SignalR server and .NET client implementations. - [x] Manual (required) - [x] Automated - [ ] Yes - [ ] No - [x] N/A ---- Bug fix to address denial of service vulnerabilities in SignalR's MessageBuffer component related to backpressure handling and resource cleanup. This PR fixes two critical issues in SignalR's MessageBuffer: a DoS vulnerability caused by indefinite blocking during backpressure scenarios and improper disposal handling. The changes add timeout mechanisms to prevent infinite waits and ensure proper resource cleanup. - `MessageBuffer.cs`: Added 5-second backpressure timeout to `ResendAsync` method with cancellation token support to prevent indefinite blocking during message resend operations - `MessageBuffer.cs`: Added backpressure timeout to `RunTimer` method's ACK message sending and implemented connection abort on timeout to prevent send-side FIN DoS attacks - `MessageBuffer.cs`: Added thread-safe disposal pattern using `Interlocked.Exchange` and wrapped timer disposal to prevent double-dispose exceptions - `MessageBufferTests.cs`: Added test coverage for backpressure timeout scenarios including `ResendBackpressureTimesOutAndUnblocksPendingWrites` and `AckBackpressureTimesOutReleasesWriteLockAndAbortsConnection` <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
|
Azure Pipelines: Successfully started running 1 pipeline(s). 1 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new abort paths do not terminate .NET client connections, leaving sending or acknowledgment processing broken after timeouts.
1 open finding
What changed in this PR
Bounds SignalR stateful-reconnect stalls to prevent blocked broadcasts and retained resources while allowing replay to continue as it makes progress.
Changes:
- Adds acknowledgment and replay timeouts, with resets after replay progress.
- Stops replay on canceled or completed flushes.
- Adds timeout, progress, and write-unblocking tests.
| File | Description |
|---|---|
| src/aspnetcore/src/SignalR/server/SignalR/test/Microsoft.AspNetCore.SignalR.Tests/Internal/MessageBufferTests.cs | Adds regression tests and controllable pipe writers. |
| src/aspnetcore/src/SignalR/common/Shared/MessageBuffer.cs | Adds bounded waits, failure handling, and guarded disposal. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
akoeplinger
approved these changes
Oct 15, 2026
Member
|
Failure is a known issue: #10115 |
wtgodbe
approved these changes
Oct 15, 2026
This was referenced Oct 19, 2026
This was referenced Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prevents malicious or abruptly disconnected stateful-reconnect clients from indefinitely blocking SignalR broadcasts and retaining server resources. Healthy reconnects remain unaffected as long as replay continues making progress.