CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-96959 · Severity: high · CVSS 7.5 · Published 2026-10-13

A denial-of-service vulnerability in Microsoft .NET's XML cryptographic signing libraries affects applications that process signed XML documents. An attacker can send specially crafted XML to cause a .NET application to consume excessive memory and CPU, leading to service unavailability or crashes. This impacts developers using System.Security.Cryptography.Xml and System.Private.Xml packages across Windows, Linux, and macOS platforms.

Technologies: Apple macOS, Linux Kernel, Microsoft .Net, Microsoft .NET Framework, Microsoft System.Security.Cryptography.Xml, Microsoft Windows, Microsoft Windows 10 1607, Microsoft Windows 10 1809, Microsoft Windows 10 21h2, Microsoft Windows 10 22h2, Microsoft Windows 11 23h2, Microsoft Windows 11 24h2, Microsoft Windows 11 25h2, Microsoft Windows 11 26h1, Microsoft Windows 11 26h2, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Server 2025, System.Security.Cryptography.Xml (NuGet). Vendors: Apple, Linux, Microsoft, NuGet.

Quick answers

Is CVE-2026-96959 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96959 being exploited in the wild.
How severe is CVE-2026-96959?
High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?
Microsoft .Net affected versions corresponding to vulnerable package versions; Microsoft System.Security.Cryptography.Xml 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1; System.Security.Cryptography.Xml (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.
Is there a fix for CVE-2026-96959?
Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later. Until then: Update System.Security.Cryptography.Xml packages to the patched versions listed above. Self-contained .NET applications targeting vulnerable versions must be recompiled and redeployed with the updated package. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96959 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-96959?
Check whether you run Apple macOS, Linux Kernel, Microsoft .Net or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later
    dotnet add package System.Security.Cryptography.Xml --version 10.0.13

Update System.Security.Cryptography.Xml packages to the patched versions listed above. Self-contained .NET applications targeting vulnerable versions must be recompiled and redeployed with the updated package.

Technical details

A resource-exhaustion vulnerability (CWE-770) in System.Security.Cryptography.Xml and System.Private.Xml allows an unauthenticated remote attacker to trigger a denial of service through unbound input depth, unbounded operation counts, DTD processing, and excessive entity references in signed XML payloads. The vulnerability requires no authentication or user interaction; applications processing untrusted signed XML over the network are affected. The fix introduces input-depth limits, operation-count limits, DTD prohibition, entity validation, and bounds on encrypted-data and C14N transform processing.

Affected products

  • Microsoft System.Security.Cryptography.Xml 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1
  • Microsoft .NET affected versions corresponding to vulnerable package versions

Identifiers

  • CVE-2026-96959
  • GHSA-c399-9853-6jmj

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.