.NET Denial of Service Flaw CVE-2026-96958 Risks Service Outages for XML Users
A high-severity algorithmic complexity flaw in Microsoft .NET libraries allows remote attackers to disrupt services across Windows, Linux, and macOS platforms.
Key points
- The vulnerability affects System.Security.Cryptography.Xml packages across .NET versions 8 through 11.
- Microsoft has released patched versions for all affected package ranges to resolve the issue.
- The flaw enables unauthorized network-based denial of service attacks via inefficient processing.
Organisations running Microsoft .NET applications that process signed XML data face a high-severity denial of service risk. Microsoft Security Update Guide details CVE-2026-96958, which stems from inefficient algorithmic complexity in the System.Security.Cryptography.Xml library. This flaw allows an unauthenticated attacker to disrupt services over a network by triggering excessive resource consumption during XML processing operations on any supported operating system.
The risk
The vulnerability carries a CVSS score of 7.5, rated as high severity by GitHub advisory GHSA-r955-8q5j-3h83. The flaw is classified as CWE-407, indicating inefficient algorithmic complexity. Attackers can exploit this weakness without needing authentication or user interaction, as shown by the CVSS vector AV:N/AC:L/PR:N/UI:N. The impact is limited to availability, but successful exploitation can cause significant service interruptions for applications relying on the affected cryptographic XML components.
Who is exposed
Developers using the System.Security.Cryptography.Xml NuGet package are exposed if they run specific version ranges. Affected versions include .NET 8.0.0 through 8.0.4, .NET 9.0.0 through 9.0.20, .NET 10.0.0 through 10.0.12, and preview releases of .NET 11.0.0. The vulnerability spans Windows, Linux, and macOS platforms, affecting all architectures. Any application integrating these specific package versions is vulnerable to the denial of service attack described in the advisory.
Cost and compliance
Microsoft has provided patched versions for all affected package ranges, mitigating the immediate risk for teams that update. The fix includes input-depth and operation-count limits, prohibits DTD processing by default, and validates entity references. These changes also bound encrypted-data candidate processing and cap attributes used by C14N transforms. Organisations must verify their dependency trees to ensure they are not using the vulnerable version ranges listed in the official advisory.
What happens next
Managers should direct engineering teams to audit their NuGet package dependencies immediately. Identify any instances of System.Security.Cryptography.Xml within the vulnerable version ranges and schedule updates to the patched versions. Monitor application logs for unusual resource spikes or processing delays that could indicate active exploitation attempts before the patches are fully deployed across production environments.
Questions to ask your suppliers
Teams usually need to verify whether third-party software components rely on vulnerable .NET libraries. Ask suppliers if their products use System.Security.Cryptography.Xml and which versions are embedded. Determine who inside the organisation is responsible for validating supplier patch timelines and testing updated components. Check whether existing service level agreements require vendors to disclose and fix such high-severity flaws within specific timeframes. Ensure procurement teams review security commitments for future software purchases.
What to do and how to stay safe: Microsoft
- Audit all production systems for the System.Security.Cryptography.Xml package and check version numbers against the affected ranges.
- Update vulnerable packages to the patched versions listed in the Microsoft advisory as soon as operational testing allows.
- Monitor application performance metrics for signs of excessive CPU or memory usage during XML processing tasks.
- Verify that all development environments use the latest stable package versions to prevent re-introduction of the flaw.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-96958?
The vulnerability affects .NET versions 8, 9, 10, and 11, specifically within the version ranges detailed in the GitHub advisory.
Is there a fix available for this vulnerability?
Yes, Microsoft has released patched versions of the System.Security.Cryptography.Xml package for all affected ranges.
What type of attack does this vulnerability enable?
It allows an unauthorized attacker to perform a denial of service attack over a network via inefficient algorithmic complexity.
