.NET Recursion Flaw CVE-2026-58280: Microsoft Patches Versions 8-11 to Block DoS Crashes

Microsoft has issued patches for a high-severity denial-of-service vulnerability in the .NET framework that allows remote attackers to crash applications. The issue stems from uncontrolled recursion within XML processing components, enabling an attacker to exhaust system resources over a network without needing authentication.

Root cause

The vulnerability exists in the System.Security.Cryptography.Xml and System.Private.Xml libraries. According to the GitHub advisory, the flaw is classified as uncontrolled recursion under CWE-674. This occurs when a function calls itself repeatedly without a proper limit, causing the application to consume excessive memory or processing power until it fails.

Attack path

An attacker can exploit this flaw remotely over a network. The Microsoft Security Update Guide states that no user interaction or prior authentication is required to trigger the issue. By sending crafted data that induces deep recursion in the XML parser, an adversary can cause the affected service to become unresponsive, resulting in a denial of service.

Affected versions

The issue impacts multiple versions of the Microsoft.NETCore.App.Runtime packages across Windows, Linux and macOS. Affected versions include .NET 8.0.0 through 8.0.31, .NET 9.0.0 through 9.0.20, and .NET 10.0.0 through 10.0.12. Preview releases of .NET 11.0.0, from preview.1 to rc.1, are also vulnerable.

Mitigation

Microsoft has released patched versions for all affected branches. For .NET 8, users should update to version 8.0.32. For .NET 9, the patched version is 9.0.21. .NET 10 users must upgrade to 10.0.13. Those using .NET 11 preview builds should move to version 11.0.0-rc.2 or later to resolve the vulnerability.

Why it matters

Uncontrolled recursion is a common software flaw where code loops indefinitely, consuming memory until the system crashes. For security teams, this highlights the risk of processing untrusted XML data without strict limits. Understanding this helps teams prioritise updates for internet-facing services that parse external inputs, ensuring they do not become easy targets for resource exhaustion attacks.

What to do and how to stay safe: Microsoft

• Audit your inventory to identify all systems running vulnerable .NET runtime versions listed in the advisory.
• Deploy the patched runtime versions (8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2) to affected servers as soon as possible.
• Monitor application logs for sudden spikes in memory usage or crashes that could indicate exploitation attempts.
• Review network traffic for anomalous patterns that might suggest remote denial-of-service activity targeting XML services.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is authentication required to exploit CVE-2026-58280?

No, the vulnerability can be exploited remotely over a network without any prior authentication or user interaction.

Which .NET versions are affected by this recursion flaw?

Versions 8, 9, 10 and specific preview releases of 11 are affected across Windows, Linux and macOS platforms.

What is the CVSS score for this vulnerability?

The flaw has a CVSS 3.1 score of 7.5, which is classified as high severity.