Is CVE-2026-26171 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26171 being exploited in the wild.

How severe is CVE-2026-26171?

High severity, with a CVSS score of 7.5, published 14 April 2026.

Which products and versions are affected?

System.Security.Cryptography.Xml (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Red Hat Enterprise Linux AppStream 8, 9, 10.

Is there a fix for CVE-2026-26171?

Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26171 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26171?

Check whether you run System.Security.Cryptography.Xml (NuGet) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26171: Microsoft .NET denial of service via XML entity expansion

CVE-2026-26171 · Severity: high · CVSS 7.5 · Published 2026-04-14

A vulnerability in Microsoft .NET could allow a remote attacker to crash applications or make them unresponsive. .NET is a widely used framework for building and running software on Windows and Linux. An exploit could lead to a service outage, preventing customers or employees from accessing critical business applications.

Technologies: System.Security.Cryptography.Xml (NuGet), Red Hat Enterprise Linux AppStream. Vendors: NuGet, Red Hat.

Quick answers

Is CVE-2026-26171 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26171 being exploited in the wild.
How severe is CVE-2026-26171?: High severity, with a CVSS score of 7.5, published 14 April 2026.
Which products and versions are affected?: System.Security.Cryptography.Xml (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Red Hat Enterprise Linux AppStream 8, 9, 10.
Is there a fix for CVE-2026-26171?: Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26171 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26171?: Check whether you run System.Security.Cryptography.Xml (NuGet) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later

dotnet add package System.Security.Cryptography.Xml --version 10.0.6

Technical details

A vulnerability exists in .NET 8.0 and 9.0 due to uncontrolled resource consumption, specifically related to improper restriction of recursive entity references in DTDs (XML Entity Expansion). An unauthenticated remote attacker can exploit this by sending specially crafted network requests to a vulnerable .NET application. Successful exploitation can lead to a denial-of-service (DoS) condition by exhausting system resources or triggering a security bypass. Microsoft and Red Hat have released security updates (e.g., .NET SDK 9.0.116 and 8.0.126) to address this issue.

Affected products

Microsoft .NET 8.0, 9.0
Red Hat Red Hat Enterprise Linux AppStream 8, 9, 10

Identifiers

CVE-2026-26171
GHSA-w3x6-4m5h-cxqf

Timeline

2026-04-14: disclosed
2026-05-04: patched: Red Hat released security advisories and updated packages.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.