Executive brief
A security vulnerability has been identified in Microsoft .NET, a widely used framework for building and running applications. The flaw exists in how the system processes XML data, specifically during encryption handling. An attacker could exploit this to cause the application to consume excessive resources or crash, leading to a denial of service that disrupts business operations and application availability.
Technical details
A denial of service vulnerability (CWE-770) exists in .NET's XML processing components, specifically within System.Security.Cryptography.Xml and System.Xml. The root cause is improper resource limit enforcement during the handling of XML encryption during parsing. A remote, unauthenticated attacker can exploit this by providing specially crafted XML content, leading to excessive resource consumption or an application crash. The vulnerability affects .NET 8, 9, and 10 across all platforms and architectures. Patches are available in .NET versions 8.0.29, 9.0.18, and 10.0.10, as well as updated NuGet packages for System.Security.Cryptography.Xml.
Affected products
- Microsoft .NET 8.0, 9.0, 10.0
- Microsoft System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.28; >= 9.0.0, <= 9.0.17; >= 10.0.0, <= 10.0.9
- Microsoft Microsoft.NetCore.App.Runtime >= 8.0.0, <= 8.0.28; >= 9.0.0, <= 9.0.17; >= 10.0.0, <= 10.0.9
Timeline
- 2026-07-14: advisory: Initial advisory publication
- 2026-07-20: advisory: Advisory updated
References
- https://github.com/dotnet/runtime/security/advisories/GHSA-cvvh-rhrc-wg4q
- https://github.com/dotnet/announcements/issues/410
- https://github.com/dotnet/runtime/issues/130708
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302
- https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-cvvh-rhrc-wg4q