Summary
Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability
Advisory details
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/449
CVSS Details
Version: 3.1
Severity: High
Score: 7.5
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness: CWE-407 (Inefficient Algorithmic Complexity)
Affected Platforms
- Platforms: Windows, Linux, macOS
- Architectures: All
Affected Packages
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- HIGHCVE-2026-96958
Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability
- HIGHCVE-2026-84008
Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
- MEDIUMCVE-2026-70196
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability
- HIGHCVE-2026-107378
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
- MEDIUMCVE-2026-107287
Pydantic AI: Excessive resource use when local web fetching converts nested HTML