NuGet · System.Security.Cryptography.Xml
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/410
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HThe vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below
| Package name | Affected version | Patched version |
|---|---|---|
| System.Security.Cryptography.Xml | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Microsoft.NetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| Package name | Affected version | Patched version |
|---|---|---|
| System.Security.Cryptography.Xml | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Microsoft.NetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.17 | 9.0.18 |
| Package name | Affected version | Patched version |
|---|---|---|
| System.Security.Cryptography.Xml | >= 8.0.0, <= 8.0.3 | 8.0.4 |
| Microsoft.NetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
| Microsoft.NetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.28 | 8.0.29 |
If using a package listed in affected packages, you're exposed to the vulnerability.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.