Microsoft Patches High-Severity .NET DoS Flaw CVE-2026-96960 in Cryptography Package

Microsoft has published security updates for the System.Security.Cryptography.Xml package to resolve a high-severity denial of service vulnerability. The flaw, tracked as CVE-2026-96960, enables unauthorized attackers to disrupt services through asymmetric resource consumption. This issue affects applications running on Windows, Linux, and macOS across all architectures.

What happened

Microsoft identified a vulnerability in the System.Security.Cryptography.Xml and System.Private.Xml components that allows for asymmetric resource consumption, also known as amplification. According to the Microsoft Security Update Guide, this flaw permits an unauthorized attacker to deny service over a network. The issue is rated high severity with a CVSS score of 7.5. The vulnerability exists in specific version ranges of the NuGet package System.Security.Cryptography.Xml.

The affected versions include .NET 8.0.0 through 8.0.4, .NET 9.0.0 through 9.0.20, and .NET 10.0.0 through 10.0.12. Additionally, preview and release candidate versions for .NET 11, specifically 11.0.0-preview.1 through 11.0.0-rc.1, are vulnerable. Microsoft has released patched versions for all affected lines. Users of .NET 8 should update to version 8.0.5, while .NET 9 users need version 9.0.21.

For the newer releases, .NET 10 users must upgrade to version 10.0.13. Those using the .NET 11 preview chain should move to version 11.0.0-rc.2. The GitHub advisory notes that the fixes add input-depth and operation-count limits to signed XML processing. The updates also prohibit Document Type Definition processing by default and validate entity references. Furthermore, the patches bound encrypted-data candidate processing and cap the attributes and namespaces used by Canonical XML transforms.

Why it matters

This vulnerability is significant because it can be exploited by an unauthorized attacker over a network without requiring user interaction or authentication. The CVSS vector indicates that the attack complexity is low and the privilege level required is none. The impact is strictly on availability, as indicated by the high availability score in the CVSS 3.1 vector. Because the flaw resides in a core cryptography package, any application using these specific versions of System.Security.Cryptography.Xml is potentially exposed.

The exposure spans all major operating systems, including Windows, Linux, and macOS. This broad platform support means that security teams managing mixed-environment deployments must verify package versions across all servers. The advisory from Microsoft emphasizes that developers should update their applications to remove the vulnerability. Failure to update leaves the application susceptible to denial of service attacks that consume resources asymmetrically.

Our take on the response

• Microsoft provided clear version ranges for both affected and patched packages across four major .NET lines.
• The fix includes multiple hardening measures, such as prohibiting DTD processing and capping namespace usage.
• Updates are available for stable releases as well as preview versions, ensuring comprehensive coverage.
• The advisory directs users to check their specific package versions against the provided table to determine exposure.

What defenders should look for

Security operations teams should monitor for unusual spikes in CPU or memory usage on servers hosting .NET applications. Look for patterns where small incoming requests trigger disproportionate resource consumption. Check application logs for errors related to XML parsing or cryptographic operations. Alert on network connections that remain open while resource usage climbs. Investigate any sudden degradation in service responsiveness that correlates with XML processing activities. Ensure that logging captures sufficient detail to trace resource exhaustion back to specific input sources.

What to do and how to stay safe: Microsoft

• Audit your production environments to identify any applications using the affected versions of System.Security.Cryptography.Xml.
• Update all vulnerable packages to the latest patched versions listed in the Microsoft advisory.
• Monitor network traffic and system resources for signs of asymmetric resource consumption or amplification attacks.
• Review XML processing configurations to ensure that unnecessary features like DTD processing are disabled where possible.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-96960?

The vulnerability affects .NET 8.0.0 to 8.0.4, .NET 9.0.0 to 9.0.20, .NET 10.0.0 to 10.0.12, and .NET 11.0.0-preview.1 to 11.0.0-rc.1.

What is the severity rating for this vulnerability?

Microsoft rates CVE-2026-96960 as high severity with a CVSS 3.1 score of 7.5.

How can developers fix this issue?

Developers should update the System.Security.Cryptography.Xml package to the patched versions: 8.0.5, 9.0.21, 10.0.13, or 11.0.0-rc.2.