System.Security.Cryptography.Xml Fixes Remote DoS via Resource Exhaustion in .NET 8-11

Microsoft has issued patches for a denial-of-service vulnerability in its .NET framework’s XML cryptography library, allowing remote attackers to deny service without authentication.

Root cause

The flaw involves allocation of resources without limits or throttling, according to the Microsoft Security Update Guide. The GitHub advisory states that signed XML fixes add input-depth and operation-count limits. It also prohibits Document Type Definition processing by default and validates entity references to bound encrypted-data candidate processing and cap attributes and namespaces used by C14N transforms.

Attack path

An unauthorized attacker can trigger the issue over a network by sending specially crafted XML data. The Microsoft Security Update Guide describes this as allocation of resources without limits or throttling. The CVSS score is 7.5, with a vector indicating network access, low complexity, no privileges required, no user interaction, and high impact on availability.

Affected versions

Developers using specific versions of the System.Security.Cryptography.Xml NuGet package are exposed. The advisory lists patched versions for four major branches: 8.0.5, 9.0.21, 10.0.13, and 11.0.0-rc.2. Versions prior to these releases, including previews and release candidates, remain vulnerable.

Mitigation

• Update System.Security.Cryptography.Xml to 8.0.5, 9.0.21, 10.0.13, or 11.0.0-rc.2 depending on your .NET version.
• Verify that all applications consuming XML signatures or encrypted data use the patched library.
• Monitor network traffic for unusual XML processing spikes that may indicate exploitation attempts.
• Review application logs for service interruptions coinciding with incoming XML requests.

Why it matters

Security teams must understand that XML processing can be computationally expensive. When parsers do not limit depth or entity expansion, attackers can force servers to consume all available memory or CPU. This type of flaw does not require stolen credentials; it exploits the inherent complexity of the data format. Teams usually check their dependency trees for outdated libraries and ensure that input validation occurs before parsing. Understanding these resource limits helps prevent service outages during peak traffic or targeted attacks.

What to do and how to stay safe: Microsoft

• Inventory all applications using System.Security.Cryptography.Xml and check their current versions against the advisory list.
• Schedule immediate updates to the patched versions once the vendor provides an update for your specific environment.
• Implement input size restrictions at the network edge or application firewall to limit the volume of incoming XML data.
• Monitor system resource usage metrics for sudden spikes that could indicate an ongoing denial-of-service attempt.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-96959?

The vulnerability affects .NET 8, 9, 10, and 11, specifically versions of System.Security.Cryptography.Xml prior to 8.0.5, 9.0.21, 10.0.13, and 11.0.0-rc.2.

Is this vulnerability being actively exploited in the wild?

The source material does not state whether the flaw is currently being exploited by attackers in the wild.

What platforms are impacted by this denial-of-service flaw?

The advisory confirms that Windows, Linux, and macOS platforms are all affected across all architectures.