# CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Source: https://junglewise.ai/threats/cve-2026-96959-microsoft-security-advisory-net-and-visual-studio-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-13  
License: CC BY 4.0 with a link back

CVE-2026-96959 · Severity: high · CVSS 7.5 · Published 2026-10-13

A denial-of-service vulnerability in Microsoft .NET's XML cryptographic signing libraries affects applications that process signed XML documents. An attacker can send specially crafted XML to cause a .NET application to consume excessive memory and CPU, leading to service unavailability or crashes. This impacts developers using System.Security.Cryptography.Xml and System.Private.Xml packages across Windows, Linux, and macOS platforms.

Technologies: [Apple macOS](https://junglewise.ai/threats/technologies/macos-tahoe), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Microsoft .Net](https://junglewise.ai/threats/technologies/microsoft-net), [Microsoft .NET Framework](https://junglewise.ai/threats/technologies/net-framework), [Microsoft System.Security.Cryptography.Xml](https://junglewise.ai/threats/technologies/microsoft-system-security-cryptography-xml), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-), [Microsoft Windows 10 1607](https://junglewise.ai/threats/technologies/windows-10-1607), [Microsoft Windows 10 1809](https://junglewise.ai/threats/technologies/windows-10-1809), [Microsoft Windows 10 21h2](https://junglewise.ai/threats/technologies/windows-10-21h2), [Microsoft Windows 10 22h2](https://junglewise.ai/threats/technologies/windows-10-22h2), [Microsoft Windows 11 23h2](https://junglewise.ai/threats/technologies/windows-11-23h2), [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2), [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2), [Microsoft Windows 11 26h1](https://junglewise.ai/threats/technologies/windows-11-26h1), [Microsoft Windows 11 26h2](https://junglewise.ai/threats/technologies/windows-11-26h2), [Microsoft Windows Server 2012](https://junglewise.ai/threats/technologies/windows-server-2012), [Microsoft Windows Server 2016](https://junglewise.ai/threats/technologies/windows-server-2016), [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019), [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022), [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025), [System.Security.Cryptography.Xml (NuGet)](https://junglewise.ai/threats/technologies/system-security-cryptography-xml). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Linux](https://junglewise.ai/threats/vendors/linux), [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-96959 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96959 being exploited in the wild.

**How severe is CVE-2026-96959?** High severity, with a CVSS score of 7.5, published 13 October 2026.

**Which products and versions are affected?** Microsoft .Net affected versions corresponding to vulnerable package versions; Microsoft System.Security.Cryptography.Xml 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1; System.Security.Cryptography.Xml (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.

**Is there a fix for CVE-2026-96959?** Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later. Until then: Update System.Security.Cryptography.Xml packages to the patched versions listed above. Self-contained .NET applications targeting vulnerable versions must be recompiled and redeployed with the updated package. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96959 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-96959?** Check whether you run Apple macOS, Linux Kernel, Microsoft .Net or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later

  ```sh
  dotnet add package System.Security.Cryptography.Xml --version 10.0.13
  ```


Update System.Security.Cryptography.Xml packages to the patched versions listed above. Self-contained .NET applications targeting vulnerable versions must be recompiled and redeployed with the updated package.

## Technical details

A resource-exhaustion vulnerability (CWE-770) in System.Security.Cryptography.Xml and System.Private.Xml allows an unauthenticated remote attacker to trigger a denial of service through unbound input depth, unbounded operation counts, DTD processing, and excessive entity references in signed XML payloads. The vulnerability requires no authentication or user interaction; applications processing untrusted signed XML over the network are affected. The fix introduces input-depth limits, operation-count limits, DTD prohibition, entity validation, and bounds on encrypted-data and C14N transform processing.

## Affected products

- Microsoft System.Security.Cryptography.Xml 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1-11.0.0-rc.1
- Microsoft .NET affected versions corresponding to vulnerable package versions

## Identifiers

- CVE-2026-96959
- GHSA-c399-9853-6jmj

## Timeline

- 2026-10-13: disclosed

## Related threats

- [Linux kernel dm-pcache buffer over-read in segment processing](https://junglewise.ai/threats/cve-2026-98868-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-pcache out-of-bounds write in cache key handling](https://junglewise.ai/threats/cve-2026-98867-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel use-after-free in scheduler cache group access](https://junglewise.ai/threats/cve-2026-98866-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel sched_ext deadlock in ops.dequeue() with DSQ lock](https://junglewise.ai/threats/cve-2026-98865-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel sched_ext task reenqueue state synchronization](https://junglewise.ai/threats/cve-2026-98864-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)