# CVE-2026-26171: Microsoft .NET denial of service via XML entity expansion

Source: https://junglewise.ai/threats/cve-2026-26171-microsoft-net-denial-of-service-via-xml-entity-expansion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-26171 · Severity: high · CVSS 7.5 · Published 2026-04-14

A vulnerability in Microsoft .NET could allow a remote attacker to crash applications or make them unresponsive. .NET is a widely used framework for building and running software on Windows and Linux. An exploit could lead to a service outage, preventing customers or employees from accessing critical business applications.

Technologies: [System.Security.Cryptography.Xml (NuGet)](https://junglewise.ai/threats/technologies/system-security-cryptography-xml), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-26171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26171 being exploited in the wild.

**How severe is CVE-2026-26171?** High severity, with a CVSS score of 7.5, published 14 April 2026.

**Which products and versions are affected?** System.Security.Cryptography.Xml (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Red Hat Enterprise Linux AppStream 8, 9, 10.

**Is there a fix for CVE-2026-26171?** Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26171 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26171?** Check whether you run System.Security.Cryptography.Xml (NuGet) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later

  ```sh
  dotnet add package System.Security.Cryptography.Xml --version 10.0.6
  ```


## Technical details

A vulnerability exists in .NET 8.0 and 9.0 due to uncontrolled resource consumption, specifically related to improper restriction of recursive entity references in DTDs (XML Entity Expansion). An unauthenticated remote attacker can exploit this by sending specially crafted network requests to a vulnerable .NET application. Successful exploitation can lead to a denial-of-service (DoS) condition by exhausting system resources or triggering a security bypass. Microsoft and Red Hat have released security updates (e.g., .NET SDK 9.0.116 and 8.0.126) to address this issue.

## Affected products

- Microsoft .NET 8.0, 9.0
- Red Hat Red Hat Enterprise Linux AppStream 8, 9, 10

## Identifiers

- CVE-2026-26171
- GHSA-w3x6-4m5h-cxqf

## Timeline

- 2026-04-14: disclosed
- 2026-05-04: patched: Red Hat released security advisories and updated packages.

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171)
- [https://access.redhat.com/errata/RHSA-2026:13280](https://access.redhat.com/errata/RHSA-2026:13280)
- [https://access.redhat.com/errata/RHSA-2026:13281](https://access.redhat.com/errata/RHSA-2026:13281)
- [https://access.redhat.com/errata/RHSA-2026:13282](https://access.redhat.com/errata/RHSA-2026:13282)
- [https://access.redhat.com/errata/RHSA-2026:13283](https://access.redhat.com/errata/RHSA-2026:13283)
- [https://access.redhat.com/errata/RHSA-2026:13693](https://access.redhat.com/errata/RHSA-2026:13693)
- [https://access.redhat.com/errata/RHSA-2026:8467](https://access.redhat.com/errata/RHSA-2026:8467)

## Related threats

- [Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96960-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96959-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96958-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Microsoft .NET certificate validation bypass in Cryptography.Xml](https://junglewise.ai/threats/cve-2026-96222-microsoft-security-advisory-net-spoofing-vulnerability)
- [Microsoft .NET Framework denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-50648-microsoft-net-framework-denial-of-service-via-resource-exhaustion)